Cyber Posture

CVE-2024-57583

Critical

Published: 16 January 2025

Published
16 January 2025
Modified
04 February 2025
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0225 84.7th percentile
Risk Priority 21 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse Unix shell commands and scripts for execution.

Security Summary

CVE-2024-57583 is a command injection vulnerability (CWE-77) in the Tenda AC18 router running firmware version V15.03.05.19. The flaw resides in the formSetSambaConf function, where the usbName parameter fails to properly sanitize user input, allowing injected commands to be executed.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating it is exploitable over the network with low complexity, no authentication or user interaction required. A remote unauthenticated attacker can send a crafted request to trigger arbitrary command injection, potentially achieving full compromise of the device with high impacts to confidentiality, integrity, and availability.

Mitigation details are available in the referenced advisory at https://github.com/qijiale/Tenda/tree/main/10.

Details

CWE(s)
CWE-77

Affected Products

tenda
ac18 firmware
15.03.05.19

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
Why these techniques?

Command injection via web parameter in router firmware enables exploitation of public-facing application (T1190) for remote code execution using Unix shell commands (T1059.004).

References