CVE-2024-57542
Published: 21 January 2025
Description
Adversaries may abuse Unix shell commands and scripts for execution.
Security Summary
CVE-2024-57542 is a command injection vulnerability (CWE-78) in the Linksys E8450 router running firmware version v1.2.00.360516. The flaw is exploitable through the "id_email_check_btn" field, allowing arbitrary command execution on the affected device.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating that an attacker on an adjacent network can exploit it with low attack complexity, no required privileges, and no user interaction. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, enabling full device compromise such as remote code execution.
References for CVE-2024-57542 direct to a GitHub repository at https://github.com/Wood1314/Linksys_E8450_vul/blob/main/4/4.md, which documents the issue but does not specify official patches or mitigation guidance in the available details.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Command injection vulnerability in the router's web interface (id_email_check_btn) enables exploitation of a public-facing application (T1190) for remote code execution via Unix shell commands (T1059.004).