CVE-2024-51431

Hardcoded credentials are stored in the /etc/shadow file of the device's operating system and cannot be changed in the standard way. These passwords are weak and easy to guess, meaning an attacker can gain access to the device without any prior authorization. The attack vector is network-based and requires no privileges or user interaction.

An attacker can obtain full, unauthorized access to the device, resulting in complete loss of confidentiality, integrity and availability of the system, as well as the ability to take control of network traffic.

Apply patches available from the manufacturer according to the references. It is also recommended to isolate the device from public network access and monitor unauthorized login attempts until the update is deployed.

LB-LINK BL-WR1300H Firmware version 1.0.4