Security Flaw in LevelOne WBR-6012 Allows for Easily Guessable Administrator Password

CVE-2024-31151

What is CVE-2024-31151?

A notable vulnerability affects the LevelOne WBR-6012 due to hard-coded credentials within its web services. Attackers can exploit this flaw within the first 30 seconds after the device boots up, allowing for unauthorized access. Furthermore, specific conditions can force a reboot of the device, enabling exploitation of this security issue outside the initial timeframe. The flawed implementation exposes a known password string that can be easily located in the firmware, leading to potential security breaches. Once adversaries gain access, they can manipulate user credentials, leveraging additional weaknesses identified in related vulnerabilities. Effective remediation and immediate attention are crucial to mitigate risks associated with this flaw.

References