Search criteria
ⓘ
Use full-text search for keyword queries.
Combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by dates instead of relevance.
10 vulnerabilities found for M120N by Billion Electric
CVE-2025-1143 (GCVE-0-2025-1143)
Vulnerability from nvd – Published: 2025-02-11 03:17 – Updated: 2025-02-18 18:00
VLAI?
Title
Billion Electric M120N - Use of Hard-coded Credentials
Summary
Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.
Severity ?
8.4 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.159.* , < 1.04.1.592.10
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.14 (custom) Affected: 1.04.1.* , < 1.04.1.676 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2025-02-11 02:54
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-11T05:24:10.391075Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T18:00:30.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.159.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-02-11T02:54:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system."
}
],
"value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system."
}
],
"impacts": [
{
"capecId": "CAPEC-191",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-191 Read Sensitive Constants Within an Executable"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-11T03:17:22.510Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8413-ec9a5-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8414-096ce-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.676 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.676 or later."
}
],
"source": {
"advisory": "TVN-202502001",
"discovery": "EXTERNAL"
},
"title": "Billion Electric M120N - Use of Hard-coded Credentials",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2025-1143",
"datePublished": "2025-02-11T03:17:22.510Z",
"dateReserved": "2025-02-10T01:51:06.133Z",
"dateUpdated": "2025-02-18T18:00:30.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11983 (GCVE-0-2024-11983)
Vulnerability from nvd – Published: 2024-11-29 06:57 – Updated: 2024-11-29 14:10
VLAI?
Title
Billion Electric router - OS Command Injection
Summary
Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2024-11-29 06:53
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m100",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11983",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T13:57:51.182205Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:10:39.561Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T06:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device."
}
],
"value": "Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T06:57:24.047Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8279-bf67e-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8280-ae6e1-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411028",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - OS Command Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11983",
"datePublished": "2024-11-29T06:57:24.047Z",
"dateReserved": "2024-11-29T01:52:22.084Z",
"dateUpdated": "2024-11-29T14:10:39.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11982 (GCVE-0-2024-11982)
Vulnerability from nvd – Published: 2024-11-29 06:45 – Updated: 2024-11-29 14:22
VLAI?
Title
Billion Electric router - Plaintext Storage of a Password
Summary
Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.
Severity ?
7.2 (High)
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2024-11-29 06:37
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m100",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11982",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T14:11:33.338160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:22:56.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T06:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCertain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.\u003c/span\u003e"
}
],
"value": "Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T06:58:03.281Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8277-88b20-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8278-cb581-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411027",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - Plaintext Storage of a Password",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11982",
"datePublished": "2024-11-29T06:45:33.819Z",
"dateReserved": "2024-11-29T01:52:20.686Z",
"dateUpdated": "2024-11-29T14:22:56.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11981 (GCVE-0-2024-11981)
Vulnerability from nvd – Published: 2024-11-29 06:21 – Updated: 2024-11-29 14:31
VLAI?
Title
Billion Electric router - Authentication Bypass
Summary
Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.
Severity ?
7.5 (High)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2024-11-29 06:16
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m100",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T14:25:30.745734Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:31:52.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T06:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCertain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.\u003c/span\u003e"
}
],
"value": "Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T06:29:10.735Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8275-50f42-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8276-1defb-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411026",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - Authentication Bypass",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11981",
"datePublished": "2024-11-29T06:21:31.476Z",
"dateReserved": "2024-11-29T01:52:19.267Z",
"dateUpdated": "2024-11-29T14:31:52.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11980 (GCVE-0-2024-11980)
Vulnerability from nvd – Published: 2024-11-29 06:03 – Updated: 2024-11-29 14:40
VLAI?
Title
Billion Electric router - Missing Authentication
Summary
Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.
Severity ?
8.6 (High)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2024-11-29 05:51
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11980",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T14:32:57.290762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:40:54.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T05:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.\u003cbr\u003e"
}
],
"value": "Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T08:39:12.739Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8273-95a07-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8274-01e55-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411025",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - Missing Authentication",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11980",
"datePublished": "2024-11-29T06:03:04.983Z",
"dateReserved": "2024-11-29T01:52:18.057Z",
"dateUpdated": "2024-11-29T14:40:54.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-1143 (GCVE-0-2025-1143)
Vulnerability from cvelistv5 – Published: 2025-02-11 03:17 – Updated: 2025-02-18 18:00
VLAI?
Title
Billion Electric M120N - Use of Hard-coded Credentials
Summary
Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.
Severity ?
8.4 (High)
CWE
- CWE-798 - Use of Hard-coded Credentials
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.159.* , < 1.04.1.592.10
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.14 (custom) Affected: 1.04.1.* , < 1.04.1.676 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2025-02-11 02:54
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-1143",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-02-11T05:24:10.391075Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-02-18T18:00:30.733Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.159.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.10",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.14",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.676",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2025-02-11T02:54:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system."
}
],
"value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system."
}
],
"impacts": [
{
"capecId": "CAPEC-191",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-191 Read Sensitive Constants Within an Executable"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-798",
"description": "CWE-798 Use of Hard-coded Credentials",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-11T03:17:22.510Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8413-ec9a5-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8414-096ce-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.676 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.676 or later."
}
],
"source": {
"advisory": "TVN-202502001",
"discovery": "EXTERNAL"
},
"title": "Billion Electric M120N - Use of Hard-coded Credentials",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2025-1143",
"datePublished": "2025-02-11T03:17:22.510Z",
"dateReserved": "2025-02-10T01:51:06.133Z",
"dateUpdated": "2025-02-18T18:00:30.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11983 (GCVE-0-2024-11983)
Vulnerability from cvelistv5 – Published: 2024-11-29 06:57 – Updated: 2024-11-29 14:10
VLAI?
Title
Billion Electric router - OS Command Injection
Summary
Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device.
Severity ?
7.2 (High)
CWE
- CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2024-11-29 06:53
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m100",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11983",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T13:57:51.182205Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:10:39.561Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T06:53:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device."
}
],
"value": "Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device."
}
],
"impacts": [
{
"capecId": "CAPEC-88",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-88 OS Command Injection"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-78",
"description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T06:57:24.047Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8279-bf67e-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8280-ae6e1-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411028",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - OS Command Injection",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11983",
"datePublished": "2024-11-29T06:57:24.047Z",
"dateReserved": "2024-11-29T01:52:22.084Z",
"dateUpdated": "2024-11-29T14:10:39.561Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11982 (GCVE-0-2024-11982)
Vulnerability from cvelistv5 – Published: 2024-11-29 06:45 – Updated: 2024-11-29 14:22
VLAI?
Title
Billion Electric router - Plaintext Storage of a Password
Summary
Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.
Severity ?
7.2 (High)
CWE
- CWE-256 - Plaintext Storage of a Password
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2024-11-29 06:37
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m100",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11982",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T14:11:33.338160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:22:56.724Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T06:37:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCertain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords.\u003c/span\u003e"
}
],
"value": "Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator privileges can access the user settings page to retrieve plaintext passwords."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-256",
"description": "CWE-256 Plaintext Storage of a Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T06:58:03.281Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8277-88b20-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8278-cb581-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411027",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - Plaintext Storage of a Password",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11982",
"datePublished": "2024-11-29T06:45:33.819Z",
"dateReserved": "2024-11-29T01:52:20.686Z",
"dateUpdated": "2024-11-29T14:22:56.724Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11981 (GCVE-0-2024-11981)
Vulnerability from cvelistv5 – Published: 2024-11-29 06:21 – Updated: 2024-11-29 14:31
VLAI?
Title
Billion Electric router - Authentication Bypass
Summary
Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.
Severity ?
7.5 (High)
CWE
- CWE-288 - Authentication Bypass Using an Alternate Path or Channel
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.1.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2024-11-29 06:16
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m100",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T14:25:30.745734Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:31:52.528Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T06:16:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eCertain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.\u003c/span\u003e"
}
],
"value": "Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-288",
"description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T06:29:10.735Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8275-50f42-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8276-1defb-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411026",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - Authentication Bypass",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11981",
"datePublished": "2024-11-29T06:21:31.476Z",
"dateReserved": "2024-11-29T01:52:19.267Z",
"dateUpdated": "2024-11-29T14:31:52.528Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-11980 (GCVE-0-2024-11980)
Vulnerability from cvelistv5 – Published: 2024-11-29 06:03 – Updated: 2024-11-29 14:40
VLAI?
Title
Billion Electric router - Missing Authentication
Summary
Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.
Severity ?
8.6 (High)
CWE
- CWE-306 - Missing Authentication for Critical Function
Assigner
References
| URL | Tags | |||||||
|---|---|---|---|---|---|---|---|---|
|
||||||||
Impacted products
| Vendor | Product | Version | |||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Billion Electric | M100 |
Affected:
1.04.1.592.* , < 1.04.1.592.8
(custom)
Affected: 1.04.1.613.* , < 1.04.613.13 (custom) Affected: 1.04.1.* , < 1.04.1.675 (custom) |
|||||||||||||||||
|
|||||||||||||||||||
Date Public ?
2024-11-29 05:51
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m150",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m120n",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
},
{
"cpes": [
"cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "m500",
"vendor": "billion_electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.* \u003c",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-11980",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-11-29T14:32:57.290762Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T14:40:54.541Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "M100",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M150",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M120N",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "M500",
"vendor": "Billion Electric",
"versions": [
{
"lessThan": "1.04.1.592.8",
"status": "affected",
"version": "1.04.1.592.*",
"versionType": "custom"
},
{
"lessThan": "1.04.613.13",
"status": "affected",
"version": "1.04.1.613.*",
"versionType": "custom"
},
{
"lessThan": "1.04.1.675",
"status": "affected",
"version": "1.04.1.*",
"versionType": "custom"
}
]
}
],
"datePublic": "2024-11-29T05:51:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.\u003cbr\u003e"
}
],
"value": "Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device."
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.6,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-306",
"description": "CWE-306 Missing Authentication for Critical Function",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-29T08:39:12.739Z",
"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"shortName": "twcert"
},
"references": [
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/tw/cp-132-8273-95a07-1.html"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.twcert.org.tw/en/cp-139-8274-01e55-2.html"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\u003cbr\u003eFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\u003cbr\u003eFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.\u003cbr\u003e"
}
],
"value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.675 or later."
}
],
"source": {
"advisory": "TVN-202411025",
"discovery": "EXTERNAL"
},
"title": "Billion Electric router - Missing Authentication",
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e",
"assignerShortName": "twcert",
"cveId": "CVE-2024-11980",
"datePublished": "2024-11-29T06:03:04.983Z",
"dateReserved": "2024-11-29T01:52:18.057Z",
"dateUpdated": "2024-11-29T14:40:54.541Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}