Vulnerability · Published Oct 30, 2024 · Assigned by talos
CVE-2024-23309
Critical 9.0
In plain English
A critical-severity security flaw in WBR-6012 from LevelOne. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 60% of all known vulnerabilities).
Severity (CVSS 3.1)9.0Critical
Exploit odds (30 days)0.9%top 39.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for authentication. Attackers could spoof an IP address to gain unauthorized access without needing a session token.
Affected products (as reported)
Weakness: CWE-291 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H