CVE-2024-57233
Published: 05 May 2025
Summary
CVE-2024-57233 is a critical-severity Command Injection (CWE-77) vulnerability in Netgear Rax50 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 7.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
The vulnerability CVE-2024-57233 is a command injection flaw (CWE-77) in the NETGEAR RAX5 AX1600 WiFi Router running firmware version 1.0.2.26. It resides in the vif_disable function, where unsanitized input to the iface parameter can be used to execute arbitrary operating system commands.
An unauthenticated attacker with network access can exploit the issue remotely by submitting a crafted request containing malicious payload in the iface parameter. Successful exploitation yields full control of the device, enabling arbitrary command execution that impacts confidentiality, integrity, and availability.
The single reference is a technical disclosure containing proof-of-concept details but provides no vendor advisory, patch information, or mitigation steps. The associated EPSS score stands at 0.0811 with no material rise from a lower baseline.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-13456
Vulnerability details
NETGEAR RAX5 (AX1600 WiFi Router) v1.0.2.26 was discovered to contain a command injection vulnerability via the iface parameter in the vif_disable function.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.