CVE-2024-57583
Published: 16 January 2025
Summary
CVE-2024-57583 is a critical-severity Command Injection (CWE-77) vulnerability in Tenda Ac18 Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 15.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-10 requires validation of information inputs like the usbName parameter to prevent command injection by rejecting or sanitizing malicious payloads.
SI-2 mandates identification, prioritization, and remediation of flaws such as this command injection vulnerability through firmware patching.
AC-3 enforces access control policies to require authentication for the formSetSambaConf function, blocking unauthenticated remote exploitation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Command injection via web parameter in router firmware enables exploitation of public-facing application (T1190) for remote code execution using Unix shell commands (T1059.004).
NVD Description
Tenda AC18 V15.03.05.19 was discovered to contain a command injection vulnerability via the usbName parameter in the formSetSambaConf function.
Deeper analysisAI
CVE-2024-57583 is a command injection vulnerability (CWE-77) in the Tenda AC18 router running firmware version V15.03.05.19. The flaw resides in the formSetSambaConf function, where the usbName parameter fails to properly sanitize user input, allowing injected commands to be executed.
The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no authentication or user interaction required. A remote unauthenticated attacker can send a crafted request to trigger arbitrary command injection, potentially achieving full compromise of the device with high impacts to confidentiality, integrity, and availability.
Mitigation details are available in the referenced advisory at https://github.com/qijiale/Tenda/tree/main/10.
Details
- CWE(s)