CVE-2024-33699

The vulnerability results from the lack of proper user identity verification during the administrator password change process in the router's web application. An attacker with only network access to the management interface can send a specially crafted password change request, bypassing current password verification (CWE-620 — Unverified Password Change). After a successful attack, the attacker obtains full administrative privileges to the device.

An attacker can gain full administrative control over the router, enabling modification of network configuration, interception of network traffic, disabling security features (firewall), or using the device as a launching point for further attacks (lateral movement) on the local network.

Patches available from the manufacturer should be applied in accordance with the references. Until updates are applied, it is recommended to restrict access to the router's management interface only to trusted hosts and isolate the device from the public internet.

LevelOne WBR-6012 with firmware version R0.40e6