{"id":"CVE-2024-28875","aliases":["EUVD-2024-25945","GHSA-4fj6-9r38-4v86"],"status":"published","title":"A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows...","description":"A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be found at address 0x80100910\r\n\r\n    80100910 40 6d 21 74        ds         \"@m!t2K1\"\r\n             32 4b 31 00\r\n             \r\nIt is referenced by the function located at 0x800b78b0 and is used as shown in the pseudocode below:\r\n\r\n    if ((SECOND_FROM_BOOT_TIME \u003c 300) \u0026\u0026\r\n        (is_equal = strcmp(password,\"@m!t2K1\")) {\r\n            return 1;}\r\n            \r\nWhere 1 is the return value to admin-level access (0 being fail and 3 being user).","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00686,"percentile":0.52922,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-798"],"published":"2024-10-30T13:35:19Z","modified":"2026-06-17T07:21:57Z","products":[{"vendor":"level1","product":"wbr-6012_firmware"},{"vendor":"levelone","product":"wbr-6012"}],"references":[{"url":"https://talosintelligence.com/vulnerability_reports/TALOS-2024-1979","tags":["Third Party Advisory"]},{"url":"https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1979"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28875"},{"url":"https://github.com/advisories/GHSA-4fj6-9r38-4v86"}],"sources":{"cve":[{"id":"CVE-2024-28875","description":"A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be found at address 0x80100910\r\n\r\n    80100910 40 6d 21 74        ds         \"@m!t2K1\"\r\n             32 4b 31 00\r\n             \r\nIt is referenced by the function located at 0x800b78b0 and is used as shown in the pseudocode below:\r\n\r\n    if ((SECOND_FROM_BOOT_TIME \u003c 300) \u0026\u0026\r\n        (is_equal = strcmp(password,\"@m!t2K1\")) {\r\n            return 1;}\r\n            \r\nWhere 1 is the return value to admin-level access (0 being fail and 3 being user).","status":"published","published":"2024-10-30T13:35:19.982Z","modified":"2025-11-03T21:54:34.037Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:34:18.597034Z"}],"euvd":[{"id":"EUVD-2024-25945","description":"A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be found at address 0x80100910\r\n\r\n    80100910 40 6d 21 74        ds         \"@m!t2K1\"\r\n             32 4b 31 00\r\n             \r\nIt is referenced by the function located at 0x800b78b0 and is used as shown in the pseudocode below:\r\n\r\n    if ((SECOND_FROM_BOOT_TIME \u003c 300) \u0026\u0026\r\n        (is_equal = strcmp(password,\"@m!t2K1\")) {\r\n            return 1;}\r\n            \r\nWhere 1 is the return value to admin-level access (0 being fail and 3 being user).","status":"published","published":"2024-10-30T13:35:19Z","modified":"2025-11-03T21:54:34Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:30.274226Z"}],"ghsa":[{"id":"GHSA-4fj6-9r38-4v86","title":"A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows...","description":"A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be found at address 0x80100910\n\n    80100910 40 6d 21 74        ds         \"@m!t2K1\"\n             32 4b 31 00\n             \nIt is referenced by the function located at 0x800b78b0 and is used as shown in the pseudocode below:\n\n    if ((SECOND_FROM_BOOT_TIME \u003c 300) \u0026\u0026\n        (is_equal = strcmp(password,\"@m!t2K1\")) {\n            return 1;}\n            \nWhere 1 is the return value to admin-level access (0 being fail and 3 being user).","status":"published","published":"2024-10-30T15:30:46Z","modified":"2025-11-04T00:31:55Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T15:04:29.580531Z"}],"nvd":[{"id":"CVE-2024-28875","description":"A security flaw involving hard-coded credentials in LevelOne WBR-6012's web services allows attackers to gain unauthorized access during the first 30 seconds post-boot. Other vulnerabilities can force a reboot, circumventing the initial time restriction for exploitation.The backdoor string can be found at address 0x80100910\r\n\r\n    80100910 40 6d 21 74        ds         \"@m!t2K1\"\r\n             32 4b 31 00\r\n             \r\nIt is referenced by the function located at 0x800b78b0 and is used as shown in the pseudocode below:\r\n\r\n    if ((SECOND_FROM_BOOT_TIME \u003c 300) \u0026\u0026\r\n        (is_equal = strcmp(password,\"@m!t2K1\")) {\r\n            return 1;}\r\n            \r\nWhere 1 is the return value to admin-level access (0 being fail and 3 being user).","status":"published","published":"2024-10-30T14:15:04.99Z","modified":"2026-06-17T07:21:57.017Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-798"],"updated_at":"2026-11-02T14:10:35.289159Z"}]}}