PT-2024-8937 · Billion Electric · Billion Electric Routers

Chiao-Lin Yu + 1 · Published 2024-11-29 · Updated 2024-12-04 · CVE-2024-11982

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Billion Electric routers (affected versions not specified)

Description: The issue concerns a plaintext storage of password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve passwords in plaintext. This could allow an unauthorized party to gain access to protected information.

Recommendations: For all affected versions, consider restricting access to the user settings page until a fix is available. As a temporary workaround, avoid using the password variable in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-256

Related Identifiers

BDU:2024-10612

CVE-2024-11982

Affected Products

Billion Electric Routers

References · 11

• https://bdu.fstec.ru/vul/2024-10612 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-11982 · Security Note
• https://twcert.org.tw/tw/cp-132-8277-88b20-1.html · Note
• https://securityonline.info/cve-2024-11980-cvss-10-critical-flaw-in-billion-electric-routers · Note
• https://twcert.org.tw/en/cp-139-8278-cb581-2.html · Note
• https://twitter.com/cracbot/status/1864187981990690989 · Twitter Post
• https://twitter.com/fletch_ai/status/1864203091454906451 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1862657483115790418 · Twitter Post
• https://t.me/latest_high_impact_cve/1596 · Telegram Post
• https://uk.billion.com/M2M/Industrial%20IoT · Note
• https://twitter.com/CVEnew/status/1862394781197844647 · Twitter Post