PT-2024-23796 · Levelone · Levelone Wbr-6012

Francesco Benvenuto + 1 · Published 2024-10-30 · Updated 2024-11-13 · CVE-2024-31151

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions LevelOne WBR-6012 (affected versions not specified)

Description A security issue exists due to hard-coded credentials in the web services of the affected device. This allows attackers to gain unauthorized access within the first 30 seconds after the device boots. Other vulnerabilities can force the device to reboot, removing the initial time limit for exploitation. The hard-coded password string is referenced by a function and can be used to gain user-level access. The password is compared using the strcmp function with the string "AriesSerenaCairryNativitaMegan". Once authenticated, it is possible to manually change the password by exploiting another issue using the HTTP POST parameter Pu (new user password).

Recommendations For LevelOne WBR-6012, as a temporary workaround, consider restricting access to the web services during the first 30 seconds post-boot to minimize the risk of exploitation. Avoid using the default hard-coded password string "AriesSerenaCairryNativitaMegan" for authentication until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2024-31151

Affected Products

Levelone Wbr-6012

References · 5

• https://osv.dev/vulnerability/CVE-2024-31151 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-31151 · Security Note
• https://t.me/latest_high_impact_cve/1429 · Telegram Post
• https://talosintelligence.com/vulnerability_reports/TALOS-2024-1979 · Note
• https://t.me/cvedetector/9432 · Telegram Post