CVE-2024-57232

The vulnerability results from insufficient validation of input data passed through the ifname parameter to the apcli_wps_gen_pincode function. An attacker can inject malicious system commands through a crafted network request. The lack of authentication requirements and user interaction makes the attack trivial to perform remotely.

An attacker can gain full control of the device by executing arbitrary system commands with the privileges of the process handling the vulnerable function, which can lead to breaches of confidentiality, integrity, and system availability.

Apply patches available from the manufacturer according to the references. As a temporary measure, it is recommended to restrict access to the device management panel exclusively to trusted local networks and disable remote management over WAN.

NETGEAR RAX5 (AX1600 WiFi Router) in firmware version V1.0.2.26