Cyber Resilience

CVE-2024-57590

CriticalRCE

Published: 27 January 2025

Published
27 January 2025
Modified
29 May 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0076 73.8th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-57590 is a critical-severity Command Injection (CWE-77) vulnerability in Trendnet Tew-632Brp Firmware. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2024-57590 is an OS command injection vulnerability (CWE-77) in TRENDnet TEW-632BRP v1.010B31 devices. The flaw exists in the CGI interface "ntp_sync.cgi", where the "ntp_server" parameter passed via POST requests to the ntp_sync.cgi binary is susceptible to injection, enabling remote attackers to execute arbitrary operating system commands.

Attackers require no privileges (PR:N) and can exploit this remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), earning a CVSS v3.1 base score of 9.8 (Critical). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing full device compromise, such as persistent access, data exfiltration, or further network pivoting from the affected router.

Details on mitigation, including any patches or workarounds, are documented in the advisory at https://github.com/IdaJea/IOT_vuln_1/blob/master/tew632/ntp_sync.md.

EU & UK References

Vulnerability details

TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntp_server" passed to the "ntp_sync.cgi" binary through a POST request.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Direct remote OS command injection in public-facing CGI enables T1190 exploitation and Unix shell command execution (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-15472Same vendor: Trendnet
CVE-2025-15471Same vendor: Trendnet
CVE-2026-7609Same vendor: Trendnet
CVE-2026-5352Same vendor: Trendnet
CVE-2026-5354Same vendor: Trendnet
CVE-2025-15139Same vendor: Trendnet
CVE-2024-46484Same vendor: Trendnet
CVE-2026-5349Same vendor: Trendnet
CVE-2026-5351Same vendor: Trendnet
CVE-2026-5355Same vendor: Trendnet

Affected Assets

trendnet
tew-632brp firmware
1.010b31

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly prevents OS command injection by requiring validation mechanisms for the ntp_server parameter in ntp_sync.cgi to reject malicious payloads.

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and patching of the specific command injection flaw in ntp_sync.cgi to eliminate the vulnerability.

SI-9 Information Input Restrictions good match
prevent

Enforces restrictions on the ntp_server input at the external CGI interface to only allow valid NTP server values, blocking injection attempts.

References