PT-2024-10253 · Linksys · Linksys E8450

Wood1314 · Published 2024-12-26 · Updated 2025-01-21 · CVE-2024-57538

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linksys E8450 version 1.2.00.360516

Description The issue is related to a buffer overflow vulnerability. The anonymous protect status field is copied to the stack without length verification, which can be exploited by a remote attacker to execute arbitrary code or cause a denial of service. The vulnerability is also associated with the sub 422eb8 function and the strncpy parameter, where the buffer is copied without checking the size of the input data.

Recommendations For Linksys E8450 version 1.2.00.360516, consider disabling the sub 422eb8 function or restricting the use of the anonymous protect status field until a patch is available. Avoid using the strncpy parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2025-00650

CVE-2024-57538

Affected Products

Linksys E8450

References · 6

• 🔥 https://github.com/Wood1314/Linksys_E8450_vul/blob/main/10/10.md · Exploit
• https://bdu.fstec.ru/vul/2025-00650 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57538 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57538 · Vendor Advisory
• https://twitter.com/CVEnew/status/1881806583824568493 · Twitter Post
• https://vuldb.com/ru/?id.292866 · Note