Cyber Posture

CVE-2024-54804

CriticalPublic PoC

Published: 31 March 2025

Published
31 March 2025
Modified
17 April 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.1025 93.2th percentile
Risk Priority 26 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2024-54804 is a command injection vulnerability (CWE-94) affecting the Netgear WNR854T router running firmware version 1.5.2 for North America. The flaw exists in the post.cgi script, where an attacker can send a specially crafted HTTP request to update the nvram parameter wan_hostname. This action forces a router reboot and triggers command injection during the process. The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity.

An unauthenticated attacker with network access to the router can exploit this vulnerability remotely with low complexity and no user interaction required. By crafting and sending the malicious request to post.cgi, the attacker injects arbitrary commands executed with elevated privileges during the reboot, potentially achieving full compromise of the device, including data theft, modification of configurations, or disruption of network services.

Further details on the vulnerability, including reproduction steps, are available in the advisory at https://faultpoint.com/post/2025-03-25-8-cves-on-the-wnr854t-junkyard/#804. No vendor patches or specific mitigations are detailed in the provided information.

Details

CWE(s)
CWE-94

Affected Products

netgear
wnr854t firmware
1.5.2

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
Why these techniques?

The CVE describes unauthenticated remote command injection via the router's public web interface (post.cgi), directly enabling T1190 for initial access to a public-facing application and T1059.004 for arbitrary Unix shell command execution with elevated privileges.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References