Search criteria
5 vulnerabilities by Billion Electric
CVE-2025-1143 (GCVE-0-2025-1143)
Vulnerability from cvelistv5 – Published: 2025-02-11 03:17 – Updated: 2025-02-18 18:00
VLAI?
Summary
Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.
Severity ?
8.4 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.159.* , < 1.04.1.592.10
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.14 (custom) Affected: 1.04.1.* , < 1.04.1.676 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-11T05:24:10.391075Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T18:00:30.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.159.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-02-11T02:54:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system."
}
],
"value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system."
}
],
"impacts": [
{
"capecId": "CAPEC-191",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-191 Read Sensitive Constants Within an Executable"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-11T03:17:22.510Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8413-ec9a5-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8414-096ce-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.676 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.676 or later."
}
],
"source": {
"advisory": "TVN-202502001",
"discovery": "EXTERNAL"
},
"title": "Billion Electric M120N - Use of Hard-coded Credentials",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2025-1143",
"datePublished": "2025-02-11T03:17:22.510Z",
"dateReserved": "2025-02-10T01:51:06.133Z",
"dateUpdated": "2025-02-18T18:00:30.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11983 (GCVE-0-2024-11983)
Vulnerability from cvelistv5 – Published: 2024-11-29 06:57 – Updated: 2024-11-29 14:10
VLAI?
Summary
Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m100",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11983",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T13:57:51.182205Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:10:39.561Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T06:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device."
}
],
"value": "Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T06:57:24.047Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8279-bf67e-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8280-ae6e1-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411028",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - OS Command Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11983",
"datePublished": "2024-11-29T06:57:24.047Z",
"dateReserved": "2024-11-29T01:52:22.084Z",
"dateUpdated": "2024-11-29T14:10:39.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11982 (GCVE-0-2024-11982)
Vulnerability from cvelistv5 – Published: 2024-11-29 06:45 – Updated: 2024-11-29 14:22
VLAI?
Summary
Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.
Severity ?
7.2 (High)
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m100",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11982",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T14:11:33.338160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:22:56.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T06:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCertain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.\u003c/span\u003e"
}
],
"value": "Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T06:58:03.281Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8277-88b20-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8278-cb581-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411027",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - Plaintext Storage of a Password",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11982",
"datePublished": "2024-11-29T06:45:33.819Z",
"dateReserved": "2024-11-29T01:52:20.686Z",
"dateUpdated": "2024-11-29T14:22:56.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11981 (GCVE-0-2024-11981)
Vulnerability from cvelistv5 – Published: 2024-11-29 06:21 – Updated: 2024-11-29 14:31
VLAI?
Summary
Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.
Severity ?
7.5 (High)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m100",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T14:25:30.745734Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:31:52.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T06:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCertain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.\u003c/span\u003e"
}
],
"value": "Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T06:29:10.735Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8275-50f42-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8276-1defb-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411026",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - Authentication Bypass",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11981",
"datePublished": "2024-11-29T06:21:31.476Z",
"dateReserved": "2024-11-29T01:52:19.267Z",
"dateUpdated": "2024-11-29T14:31:52.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11980 (GCVE-0-2024-11980)
Vulnerability from cvelistv5 – Published: 2024-11-29 06:03 – Updated: 2024-11-29 14:40
VLAI?
Summary
Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.
Severity ?
8.6 (High)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11980",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T14:32:57.290762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:40:54.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T05:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.\u003cbr\u003e"
}
],
"value": "Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T08:39:12.739Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8273-95a07-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8274-01e55-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411025",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - Missing Authentication",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11980",
"datePublished": "2024-11-29T06:03:04.983Z",
"dateReserved": "2024-11-29T01:52:18.057Z",
"dateUpdated": "2024-11-29T14:40:54.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}