CVE-2024-11980

Billion Electric router - Missing Authentication

Published Nov 29, 2024 CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Description

Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Billion Electric

M100

unaffected

Version	Status	Constraints
`1.04.1.592.*`	affected	< 1.04.1.592.8
`1.04.1.613.*`	affected	< 1.04.613.13
`1.04.1.*`	affected	< 1.04.1.675

Billion Electric

M150

unaffected

Version	Status	Constraints
`1.04.1.592.*`	affected	< 1.04.1.592.8
`1.04.1.613.*`	affected	< 1.04.613.13
`1.04.1.*`	affected	< 1.04.1.675

Billion Electric

M120N

unaffected

Version	Status	Constraints
`1.04.1.592.*`	affected	< 1.04.1.592.8
`1.04.1.613.*`	affected	< 1.04.613.13
`1.04.1.*`	affected	< 1.04.1.675

Billion Electric

M500

unaffected

Version	Status	Constraints
`1.04.1.592.*`	affected	< 1.04.1.592.8
`1.04.1.613.*`	affected	< 1.04.613.13
`1.04.1.*`	affected	< 1.04.1.675

No data.

No data available yet.

Remediation

Vendor Solution

For firmware version 1.04.1.592.x, please update to 1.04.1.592.8 or later. For firmware version 1.04.1.613.x, please update to 1.04.1.613.13 or later. For all other firmware version 1.04.1.x, please update to 1.04.1.675 or later.

Tracking

Advisories

Source	ID	Title
EUVD	EUVD-2024-34037	Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.460% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-8274-01e55-2.html
https://www.twcert.org.tw/tw/cp-132-8273-95a07-1.html

History

Nov 29, 2024 3:15 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		Billion Electric Billion Electric m120n Billion Electric m150 Billion Electric m500
CPEs		cpe:2.3:a:billion_electric:m120n:::::::: cpe:2.3:a:billion_electric:m150:::::::: cpe:2.3:a:billion_electric:m500::::::::
Vendors & Products		Billion Electric Billion Electric m120n Billion Electric m150 Billion Electric m500
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Nov 29, 2024 9:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H'}`

Nov 29, 2024 6:30 AM Description updated. Title updated View changes

Type	Values Removed	Values Added
Description	Certain modes of in-vehicle routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.	Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.
Title	Billion Electric in-vehicle router - Missing Authentication	Billion Electric router - Missing Authentication

Nov 29, 2024 6:15 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Certain modes of in-vehicle routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.
Title		Billion Electric in-vehicle router - Missing Authentication
Weaknesses		CWE-306
References		https://www.twcert.org.tw/en/cp-139-8274-01e55-2.html https://www.twcert.org.tw/tw/cp-132-8273-95a07-1.html
Metrics		cvssV3_1 `{'score': 10, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H'}`