Cisco Talos: LevelOne WBR-6012 Router Unverified Password Change Vulnerability (CVE-2024-33699)

From this webpage screenshot, the following key information about the vulnerability can be obtained: 1. Vulnerability ID: TALOS-2024-1984 2. Vulnerability Name: LevelOne WBR-6012 Web Application weak authentication vulnerability 3. Release Date: October 30, 2024 4. CVE ID: CVE-2024-33699 5. Vulnerability Description: The web application of the LevelOne WBR-6012 router, in firmware version R0.40e6, contains a vulnerability that allows an attacker to change the administrator password and gain higher privileges without knowing the current password. 6. Affected Version: LevelOne WBR-6012 R0.40e6 7. Product URL: WBR-6012 - https://us.level1.com/products/wbr-6012 8. CVSSv3 Score: 9.9 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H 9. CWE ID: CWE-620 - Unverified Password Change 10. Vulnerability Details: The WBR-6012 is a low-cost SOHO router with simple configuration and operation. Its web application allows password changes via HTTP, which requires validation; however, this validation can be bypassed using other vulnerabilities such as CSRF or IP spoofing. 11. PoC Code: Demonstrates how to change the password via HTTP POST parameter “Pa” without needing to know the current password. 12. Timeline: The process of vulnerability discovery and public disclosure from June 3, 2024, to October 30, 2024. 13. Discoverers: Patrick DeSantis and Francesco Benvenuto, from the Cisco Talos team. This information provides a detailed description of the vulnerability, including its impact, severity rating, and discovery timeline.

Goal Reached Thanks to every supporter — we hit 100%!

Cisco Talos: LevelOne WBR-6012 Router Unverified Password Change Vulnerability (CVE-2024-33699)