CVE-2024-57357
Published: 07 February 2025
Summary
CVE-2024-57357 is a high-severity OS Command Injection (CWE-78) vulnerability in Tp-Link Tl-Wpa8630 Firmware. Its CVSS base score is 8.0 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 6.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents command injection vulnerability by enforcing input validation and error handling on the 'devpwd' parameter in function sub_4256CC.
Remediates the specific firmware flaw enabling remote code execution through timely identification and patching.
Mitigates the adjacent network access vector (AV:A) required for low-privilege exploitation by controlling communications at network boundaries.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection in network device firmware directly enables remote exploitation of the device's web/management interface (T1190) and arbitrary command execution via Unix shell (T1059.004).
NVD Description
An issue in TPLINK TL-WPA 8630 TL-WPA8630(US)_V2_2.0.4 Build 20230427 allows a remote attacker to execute arbitrary code via function sub_4256CC, which allows command injection by injecting 'devpwd'.
Deeper analysisAI
CVE-2024-57357 is a command injection vulnerability (CWE-78) affecting the TP-Link TL-WPA8630(US)_V2_2.0.4 Build 20230427 firmware on the TL-WPA 8630 powerline adapter. The issue resides in the function sub_4256CC, which enables a remote attacker to execute arbitrary code by injecting the 'devpwd' parameter.
According to its CVSS v3.1 base score of 8.0 (AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), the vulnerability can be exploited by an attacker with adjacent network access and low privileges. No user interaction is required, allowing the attacker to achieve high impacts on confidentiality, integrity, and availability through remote code execution.
Details on the vulnerability, including exploit information, are documented in the GitHub repository at https://github.com/c10uds/tplink-wpa8630-rce-vulnerability. No official patch or mitigation guidance from the vendor is specified in available references.
Details
- CWE(s)