CVE-2024-1404 is a medium severity (CVSS 4.3) information disclosure in the web management interface of the Linksys WRT54GL, firmware 4.30.18. The /SysInfo.htm page can reveal device information. The record says the vendor did not respond, so no fix is documented. Limit who can reach the admin interface.
What's affected
The record names the Linksys WRT54GL running version 4.30.18, and the issue sits in the file /SysInfo.htm of the web management interface.
The record says the vendor was contacted early about this disclosure and did not respond in any way. It lists no fixed firmware. The WRT54GL is an old router model, so you should not expect new firmware. The public disclosure and a write-up are referenced from the record, and VulDB lists the identifier VDB-253328.
Other firmware versions may behave the same way, but the record only names 4.30.18.
How to check if you're exposed
Open the router's status page and read the firmware version. If it shows 4.30.18, you are in the affected set.
Then check who can reach the admin interface. On a typical home or small office network the interface answers only on the LAN. The risk grows when remote administration is enabled, because then the disclosure page may be reachable from the internet. Look for the remote management setting in the router's administration menu and confirm it is off.
To check a whole codebase at once, run the free in-browser dependency scan at gold.safeguard.sh/scan. You can also look up the CVE in the Gold directory, and use reachability analysis to see whether your code calls the affected path.
What to do now
- Confirm the firmware version on each WRT54GL you operate.
- Turn off remote administration so the interface is reachable from the LAN only.
- Restrict LAN access to the admin page to a management machine if the router supports it.
- Change the admin password if it is the factory default.
- Plan to replace the unit with a model that still receives security updates.
Why it matters
The weakness is CWE-200, exposure of sensitive information to an unauthorized actor. A status page returned details that the person asking had not proved they were allowed to see.
The score is modest because the issue only discloses information. The record says the exploit is public, but it does not say this was exploited in the wild, and the KEV flag is false. The larger lesson is lifecycle: a router with no vendor response and no firmware path is a device you manage by exposure, not by patching.
Quick check
Is there a patch?
The record lists none, and says the vendor never responded.
Can this be reached from the internet?
Only if remote administration is on or the interface is otherwise published. Check that setting first.
Sources
- VulDB entry 253328 (listed in the NVD record, not retrieved)
- Public write-up referenced by the record (listed in the NVD record, not retrieved)
- NVD record data for CVE-2024-1404
Last reviewed: 19 October 2026.
