PT-2024-10259 · Linksys · Linksys E8450

Wood1314 · Published 2024-12-26 · Updated 2025-01-22 · CVE-2024-57541

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Linksys E8450 version 1.2.00.360516

Description The issue is related to a buffer overflow vulnerability. The ipv6 protect status field is copied to the stack without length verification, which can lead to a buffer overflow. This potentially allows attackers to execute arbitrary code on the affected device. The vulnerability is related to the function sub 422eb8 and the use of strncpy without checking the size of the input data.

Recommendations For Linksys E8450 version 1.2.00.360516, as a temporary workaround, consider restricting access to the ipv6 protect status field until a patch is available. Additionally, avoid using the strncpy function without proper length verification to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

BDU:2025-00656

CVE-2024-57541

Affected Products

Linksys E8450

References · 7

• 🔥 https://github.com/Wood1314/Linksys_E8450_vul/blob/main/9/9.md · Exploit
• https://bdu.fstec.ru/vul/2025-00656 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-57541 · Security Note
• https://osv.dev/vulnerability/CVE-2024-57541 · Vendor Advisory
• https://t.me/cvenotify/108293 · Telegram Post
• https://vuldb.com/?id.292853 · Note
• https://twitter.com/CVEnew/status/1881806586387271708 · Twitter Post