Cyber Posture

CVE-2024-57224

CriticalPublic PoC

Published: 10 January 2025

Published
10 January 2025
Modified
16 April 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0288 86.3th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.

Security Summary

CVE-2024-57224 is a command injection vulnerability (CWE-77) in the Linksys E7350 router running firmware version 1.1.00.032. The flaw resides in the apcli_do_enr_pin_wps function, where the ifname parameter fails to properly sanitize user input, allowing arbitrary command execution. The vulnerability has a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its high impact on confidentiality, integrity, and availability.

Remote attackers can exploit this vulnerability over the network without authentication, privileges, or user interaction. By crafting malicious requests to the affected function, an attacker can inject and execute arbitrary operating system commands on the router, potentially leading to full device compromise, data theft, persistent access, or use as a pivot point in the network.

A detailed proof-of-concept and vulnerability analysis is available in the GitHub repository at https://github.com/yanggao017/vuln/blob/main/Linksys/E7350/CI_3_apcli_do_enr_pin_wps/README.md. No official patches or mitigation guidance from Linksys or other advisories were referenced in the available information.

Details

CWE(s)
CWE-77

Affected Products

linksys
e7350 firmware
1.1.00.032

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.008 Network Device CLI Execution
Adversaries may abuse scripting or built-in command line interpreters (CLI) on network devices to execute malicious command and payloads.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

The command injection vulnerability in the router's apcli_do_enr_pin_wps function via the ifname parameter allows remote exploitation of a public-facing web application/service (T1190, T1210), enabling arbitrary command execution equivalent to network device CLI access (T1059.008).

References