CVE-2024-31151

A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The password string can be found at addresses 0x 803cdd0f and 0x803da3e6: 803cdd0f 41 72 69 65 ds "AriesSerenaCairryNativitaMegan" 73 53 65 72 65 6e 61 43 ... It is referenced by the function at 0x800b78b0 and simplified in the pseudocode below: if (is_equal = strcmp(password,"AriesSerenaCairryNativitaMegan"){ ret = 3;} Where 3 is the return value to user-level access (0 being fail and 1 being admin/backdoor). While there's no legitimate functionality to change this password, once authenticated it is possible manually make a change by taking advantage of TALOS-2024-XXXXX using HTTP POST paramater "Pu" (new user password) in place of "Pa" (new admin password).

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://talosintelligence.com/vulnerability_reports/TALOS-2024-1979	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:level1:wbr-6012_firmware:r0.40e6:*:*:*:*:*:*:*

cpe:2.3:h:level1:wbr-6012:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2024-10-30 14:15

Updated : 2024-11-13 18:19

NVD link : CVE-2024-31151

Mitre link : CVE-2024-31151

CVE.ORG link : CVE-2024-31151

JSON object : View

Products Affected

level1

wbr-6012
wbr-6012_firmware

CWE

CWE-798

Use of Hard-coded Credentials

{"id": "CVE-2024-31151", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "talos-cna@cisco.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2024-10-30T14:15:05.507", "references": [{"url": "https://talosintelligence.com/vulnerability_reports/TALOS-2024-1979", "tags": ["Third Party Advisory"], "source": "talos-cna@cisco.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "talos-cna@cisco.com", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The password string can be found at addresses 0x 803cdd0f and 0x803da3e6:\r\n\r\n 803cdd0f 41 72 69 65 ds \"AriesSerenaCairryNativitaMegan\"\r\n 73 53 65 72 \r\n 65 6e 61 43\r\n ...\r\n\r\nIt is referenced by the function at 0x800b78b0 and simplified in the pseudocode below:\r\n\r\n if (is_equal = strcmp(password,\"AriesSerenaCairryNativitaMegan\"){\r\n ret = 3;}\r\n\r\nWhere 3 is the return value to user-level access (0 being fail and 1 being admin/backdoor).\r\n\r\nWhile there's no legitimate functionality to change this password, once authenticated it is possible manually make a change by taking advantage of TALOS-2024-XXXXX using HTTP POST paramater \"Pu\" (new user password) in place of \"Pa\" (new admin password)."}, {"lang": "es", "value": "Una falla de seguridad que involucra credenciales codificadas en los servicios web de LevelOne WBR-6012 permite a los atacantes obtener acceso no autorizado durante los primeros 30 segundos posteriores al arranque. Otras vulnerabilidades pueden forzar un reinicio, eludiendo la restricci\u00f3n de tiempo inicial para la explotaci\u00f3n. La cadena de contrase\u00f1a se puede encontrar en las direcciones 0x 803cdd0f y 0x803da3e6: 803cdd0f 41 72 69 65 ds \"AriesSerenaCairryNativitaMegan\" 73 53 65 72 65 6e 61 43 ... La funci\u00f3n hace referencia a ella en 0x800b78b0 y se simplifica en el pseudoc\u00f3digo siguiente: if (is_equal = strcmp(password,\"AriesSerenaCairryNativitaMegan\"){ ret = 3;} Donde 3 es el valor de retorno para el acceso a nivel de usuario (0 es error y 1 es administrador/puerta trasera). Si bien no hay una funcionalidad leg\u00edtima para cambiar esta contrase\u00f1a, una vez autenticado es posible realizar un cambio manualmente aprovechando TALOS-2024-XXXXX mediante HTTP POST par\u00e1metro \"Pu\" (nueva contrase\u00f1a de usuario) en lugar de \"Pa\" (nueva contrase\u00f1a de administrador)."}], "lastModified": "2024-11-13T18:19:26.453", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:level1:wbr-6012_firmware:r0.40e6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FCC94B2E-4651-4E98-90A1-CB53CC2E24CC"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:level1:wbr-6012:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1FD255E3-0DBF-440C-AC6A-90B30DB59B34"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "talos-cna@cisco.com"}