Cyber Posture

CVE-2024-57223

CriticalPublic PoC

Published: 10 January 2025

Published
10 January 2025
Modified
16 April 2025
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0225 84.7th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2024-57223 is a command injection vulnerability (CWE-77) affecting the Linksys E7350 router in version 1.1.00.032. The issue resides in the apcli_wps_gen_pincode function, where the ifname parameter fails to properly sanitize user input, allowing arbitrary command execution. Published on January 10, 2025, it carries a CVSS v3.1 base score of 9.8 (Critical), reflecting its network accessibility, low attack complexity, lack of required privileges or user interaction, and high impacts across confidentiality, integrity, and availability.

Remote attackers can exploit this vulnerability without authentication by sending crafted requests to the affected function. Successful exploitation grants attackers the ability to execute arbitrary commands on the router's underlying operating system, potentially leading to complete device compromise, data theft, persistent access, or use as a pivot point in the network.

Mitigation details and a proof-of-concept are documented in the GitHub advisory at https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_6_apcli_wps_gen_pincode/README.md. No official vendor patches or workarounds are specified in available information.

Details

CWE(s)
CWE-77

Affected Products

linksys
e7350 firmware
1.1.00.032

MITRE ATT&CK Enterprise Techniques

T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Command injection via the ifname parameter in the router's apcli_wps_gen_pincode function enables remote exploitation of a public-facing web application (T1190) and arbitrary command execution on the network device (T1059.008).

References