CVE-2024-57725
Published: 14 February 2025
Summary
CVE-2024-57725 is a medium-severity Missing Authentication for Critical Function (CWE-306) vulnerability. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-14 (Permitted Actions Without Identification or Authentication) and AC-3 (Access Enforcement).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the missing authentication for the critical /firstconnection.cgi endpoint by identifying and restricting actions like GPON link modification that can be performed without identification or authentication.
Requires unique identification and authentication for non-organizational users accessing router interfaces, preventing unauthorized modification of the GPON link value.
Enforces approved access authorizations to block unauthenticated remote or local attackers from exploiting the /firstconnection.cgi endpoint to disrupt internet service.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Missing authentication on public CGI endpoint directly enables exploitation of the router's web interface (T1190); resulting GPON modification produces DoS but no other Enterprise techniques are directly facilitated.
NVD Description
An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication, causing an internet service disruption via the /firstconnection.cgi endpoint.
Deeper analysisAI
CVE-2024-57725 is a vulnerability in the Arcadyan Livebox Fibra PRV3399B_B_LT router that allows a remote or local attacker to modify the GPON link value without authentication. This issue is exploitable through the /firstconnection.cgi endpoint and is classified under CWE-306 (Missing Authentication for Critical Function). The CVSS v3.1 base score is 6.5, reflecting medium severity with high impact on availability.
An attacker with adjacent network access (AV:A) can exploit this vulnerability with low complexity, no privileges, and no user interaction required. Successful exploitation modifies the GPON link value, resulting in a denial-of-service condition that disrupts internet service (C:N/I:N/A:H), without affecting confidentiality or integrity.
The primary reference for this vulnerability is available at https://github.com/pointedsec/CVE-2024-57725, which provides further details discovered by pointedsec. No additional patch or mitigation advisories are specified in the available information.
Details
- CWE(s)