CVE-2024-57230 is a critical severity command injection flaw (CVSS 9.8) in NETGEAR RAX5 (AX1600 WiFi Router) firmware V1.0.2.26. The ifname parameter of the apcli_do_enr_pin_wps function reaches a system command without safe handling. We could not confirm a fixed version, so check NETGEAR's firmware page.
What's affected
The record says NETGEAR RAX5 (AX1600 WiFi Router) V1.0.2.26 contains a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps function. The NVD product list names the model as rax50, while the description and the researcher's write-up say RAX5. Check the model label on your router rather than assuming from the name.
This is one of seven related entries, CVE-2024-57229 through CVE-2024-57235, from the same researcher. Each concerns a different function in the same firmware, and the write-up for this one is number 3 in the series. The function name points to a WPS enrollee PIN routine.
No NETGEAR advisory is linked in the record, so no fixed version is confirmed. The write-up links to the firmware download page for V1.0.2.26 and to NETGEAR's support download page for the model. Treat V1.0.2.26 as affected and check the support page for anything newer.
How to check if you're exposed
Log in to the router's admin page and read the firmware version on the status or firmware update screen. If it reads V1.0.2.26, it is the version named in the record.
Then look at exposure, because that decides how fast you need to move.
- Is remote management turned on? Anything that lets people reach the admin interface from the internet raises the risk.
- Who is on the local network? The router's web interface is normally reachable from every device on the LAN and from guest networks if they are not isolated.
- Is the Wi-Fi password strong, and have you changed the default admin password?
The vector in the record shows network access with no privileges required. The write-up for this issue describes requests sent to the router's web interface. Whether a login is needed may vary by write-up, so do not rely on the login page as protection.
What to do now
- Check NETGEAR's support page for the RAX5 model and install any firmware newer than V1.0.2.26.
- Turn off remote management of the router so the admin interface is not reachable from the internet.
- Change the router admin password to a long, unique one, and make sure the Wi-Fi password is strong.
- Keep guest devices and smart home gadgets on an isolated guest network, if the router supports it.
- Replace the router if NETGEAR no longer supports the model, since devices at end of life stop getting fixes.
- Watch for unexplained changes in router settings, such as DNS servers you did not set or unknown port forwards.
Why it matters
The record classes this as CWE-77, command injection. The router's web interface passes the value of the ifname parameter into a shell command. If the code does not strictly limit what that value can contain, parts of it can be read by the shell as extra instructions. The result is that someone who can reach the interface can make the router run commands, on a device that sits between your network and the internet.
Routers are a rich target. They see all the traffic, they usually run for years without updates and they rarely have security monitoring. The vector in the record shows network access, low complexity and no privileges, with high impact on confidentiality, integrity and availability, which gives 9.8. The KEV flag in the record is false. The fix pattern for the maker is to avoid shell calls altogether, or to check each value against a strict allow list. For you, the lasting protection is firmware updates and a small exposed surface.
Quick check
Which function does CVE-2024-57230 affect?
The record names the apcli_do_enr_pin_wps function, through the ifname parameter.
Is there a patch?
We could not confirm a fixed version from the sources. Check NETGEAR's support page for the model and ask NETGEAR support if nothing is listed.
Sources
Last reviewed: 19 October 2026.
