PT-2025-3466

CVE-2024-57539

Published

2025-01-21

Updated

2025-01-22

Description by

CVSS 2.0

8.5

High

MetricsAV:N/AC:L/Au:N/C:P/I:C/A:N

Name of the Vulnerable Software and Affected Versions Linksys E8450 version 1.2.00.360516

Description A command injection issue was discovered, which can be exploited via the userEmail variable. This allows for potential unauthorized access and control.

Recommendations For Linksys E8450 version 1.2.00.360516, as a temporary workaround, consider restricting access to the userEmail variable until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

CWE-77: Improper Neutralization of Special Elements used in a Command (\'Command Injection\')

Related identifiers

CVE-2024-57539