CVE-2024-23309

The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for authentication. Attackers could spoof an IP address to gain unauthorized access without needing a session token.

Affected

LevelOne · WBR-6012

CVSS v3.1 NVD

8.1 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 CISCO

9.0 CRITICALCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

EPSS

0.92% chance of exploitation in the next 30 days, 59th percentile

Published

2024-10-30

Proof-of-concept exploits (1)

• https://talosintelligence.com/vulnerability_reports/TALOS-2024-1996

References

• CVE Record
• NVD entry