CVE-2024-28875

A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be found at address 0x80100910 80100910 40 6d 21 74 ds "@m!t2K1" 32 4b 31 00 It is referenced by the function located at 0x800b78b0 and is used as shown in the pseudocode below: if ((SECOND_FROM_BOOT_TIME < 300) && (is_equal = strcmp(password,"@m!t2K1")) { return 1;} Where 1 is the return value to admin-level access (0 being fail and 3 being user).

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1979	Third Party Advisory
https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1979

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:level1:wbr-6012_firmware:r0.40e6:*:*:*:*:*:*:*

cpe:2.3:h:level1:wbr-6012:-:*:*:*:*:*:*:*

History

03 Nov 2025, 22:16

Type	Values Removed	Values Added
References		() https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1979 -

Information

Published : 2024-10-30 14:15

Updated : 2025-11-03 22:16

NVD link : CVE-2024-28875

Mitre link : CVE-2024-28875

CVE.ORG link : CVE-2024-28875

JSON object : View

Products Affected

level1

wbr-6012
wbr-6012_firmware

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2024-28875", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "published": "2024-10-30T14:15:04.990", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1979", "tags": ["Third Party Advisory"], "source": "talos-cna@cisco.com"}, {"url": "https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1979", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be found at address 0x80100910\r\n\r\n 80100910 40 6d 21 74 ds \"@m!t2K1\"\r\n 32 4b 31 00\r\n \r\nIt is referenced by the function located at 0x800b78b0 and is used as shown in the pseudocode below:\r\n\r\n if ((SECOND_FROM_BOOT_TIME < 300) &&\r\n (is_equal = strcmp(password,\"@m!t2K1\")) {\r\n return 1;}\r\n \r\nWhere 1 is the return value to admin-level access (0 being fail and 3 being user)."}, {"lang": "es", "value": "Una falla de seguridad que involucra credenciales codificadas de forma r\u00edgida en los servicios web de LevelOne WBR-6012 permite a los atacantes obtener acceso no autorizado durante los primeros 30 segundos posteriores al arranque. Otras vulnerabilidades pueden forzar un reinicio, eludiendo la restricci\u00f3n de tiempo inicial para la explotaci\u00f3n. La cadena de puerta trasera se puede encontrar en la direcci\u00f3n 0x80100910 80100910 40 6d 21 74 ds \"@m!t2K1\" 32 4b 31 00 La funci\u00f3n ubicada en 0x800b78b0 hace referencia a ella y se utiliza como se muestra en el pseudoc\u00f3digo a continuaci\u00f3n: if ((SECOND_FROM_BOOT_TIME < 300) && (is_equal = strcmp(password,\"@m!t2K1\")) { return 1;} Donde 1 es el valor de retorno al acceso de nivel de administrador (0 es error y 3 es usuario)."}], "lastModified": "2025-11-03T22:16:50.777", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:level1:wbr-6012_firmware:r0.40e6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCC94B2E-4651-4E98-90A1-CB53CC2E24CC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:level1:wbr-6012:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1FD255E3-0DBF-440C-AC6A-90B30DB59B34"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "talos-cna@cisco.com"}