CVE-2024-57590
Published: 27 January 2025
Summary
CVE-2024-57590 is a critical-severity Command Injection (CWE-77) vulnerability in Trendnet Tew-632Brp Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 26.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly prevents OS command injection by requiring validation mechanisms for the ntp_server parameter in ntp_sync.cgi to reject malicious payloads.
Requires timely identification, reporting, and patching of the specific command injection flaw in ntp_sync.cgi to eliminate the vulnerability.
Enforces restrictions on the ntp_server input at the external CGI interface to only allow valid NTP server values, blocking injection attempts.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote OS command injection in public-facing CGI enables T1190 exploitation and Unix shell command execution (T1059.004).
NVD Description
TRENDnet TEW-632BRP v1.010B31 devices have an OS command injection vulnerability in the CGl interface "ntp_sync.cgi",which allows remote attackers to execute arbitrary commands via parameter "ntp_server" passed to the "ntp_sync.cgi" binary through a POST request.
Deeper analysisAI
CVE-2024-57590 is an OS command injection vulnerability (CWE-77) in TRENDnet TEW-632BRP v1.010B31 devices. The flaw exists in the CGI interface "ntp_sync.cgi", where the "ntp_server" parameter passed via POST requests to the ntp_sync.cgi binary is susceptible to injection, enabling remote attackers to execute arbitrary operating system commands.
Attackers require no privileges (PR:N) and can exploit this remotely over the network (AV:N) with low complexity (AC:L) and no user interaction (UI:N), earning a CVSS v3.1 base score of 9.8 (Critical). Successful exploitation grants high impacts on confidentiality, integrity, and availability (C:H/I:H/A:H), potentially allowing full device compromise, such as persistent access, data exfiltration, or further network pivoting from the affected router.
Details on mitigation, including any patches or workarounds, are documented in the advisory at https://github.com/IdaJea/IOT_vuln_1/blob/master/tew632/ntp_sync.md.
Details
- CWE(s)