CVE-2024-31151

Executive Summary

CVE-2024-31151 exposes a critical hard-coded credential vulnerability in the LevelOne WBR-6012 router. The device’s web services contain a static password string (AriesSerenaCairryNativitaMegan) that grants user-level access (return value 3) when supplied. This password is embedded in firmware at addresses 0x803cdd0f and 0x803da3e6 and is referenced by the function at 0x800b78b0. The vulnerability is exploitable only during the first 30 seconds after a device reboot; however, other unpatched flaws can force a reboot, effectively bypassing this time restriction. Once authenticated, an attacker can escalate privileges by manipulating HTTP POST parameters (e.g., using Pu instead of Pa to change the user password). No official patch is available, and the vendor has not acknowledged the issue.

Note: This is a network device vulnerability, not a WordPress plugin issue. No supply chain package context applies.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

Threat Level: Critical. The hard-coded credential allows unauthenticated remote attackers to gain user-level access, and combined with other vulnerabilities, can lead to full device compromise.

Deep Dive & Mechanics

The vulnerability stems from a hard-coded password string embedded in the firmware binary. The password AriesSerenaCairryNativitaMegan is stored at memory addresses 0x803cdd0f and 0x803da3e6. The function at 0x800b78b0 performs a strcmp against this string. If the comparison succeeds, the function returns 3, which corresponds to user-level access (0 = fail, 1 = admin/backdoor). The password cannot be changed through legitimate means, but once authenticated, an attacker can modify it by sending an HTTP POST request with the parameter Pu (new user password) instead of Pa (new admin password), exploiting a separate vulnerability (TALOS-2024-XXXXX).

The 30-second post-boot window is the only time the hard-coded credential is accepted. However, other unpatched vulnerabilities can force a reboot, allowing an attacker to repeatedly trigger the window. This makes the vulnerability persistently exploitable.

Vulnerable vs. Patched Code

Vulnerable Code (pseudocode from firmware):

if (is_equal = strcmp(password, "AriesSerenaCairryNativitaMegan")) {
    ret = 3; // user-level access
}

Patched Code: No official patch exists. A hypothetical fix would remove the hard-coded credential and implement proper authentication, such as:

if (authenticate_user(username, password) == SUCCESS) {
    ret = get_user_level(username);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• LevelOne WBR-6012 router with default firmware.
• Network access to the router’s web interface (typically port 80 or 443).
• Ability to trigger a reboot (e.g., via another vulnerability or physical access).

Exploitation Steps:

1. Trigger Reboot: Send a malicious request to exploit another vulnerability (e.g., TALOS-2024-XXXXX) to force a reboot.
2. Wait for Boot: Immediately after reboot, the 30-second window begins.
3. Authenticate: Send an HTTP POST request to the login endpoint with the hard-coded password:

   curl -X POST http://<router-ip>/login -d "username=user&password=AriesSerenaCairryNativitaMegan"
   

4. Escalate Privileges: Once authenticated, change the user password to maintain access:

   curl -X POST http://<router-ip>/change_password -d "Pu=newpassword"
   

5. Gain Admin Access: Use the new password to log in as admin (if the Pu parameter grants admin rights) or exploit further.

Note: No public exploit-db code is available for this CVE.

Blue Team

Detection:

• Monitor for rapid reboots of LevelOne WBR-6012 devices.
• Log all authentication attempts and flag the string AriesSerenaCairryNativitaMegan in POST parameters.
• Alert on HTTP requests containing Pu parameter changes.

Honeypot: Deploy a fake LevelOne WBR-6012 web interface that logs all credentials and triggers alerts on the hard-coded password.

Indicators of Compromise (IOCs)

• Network:
  • HTTP POST requests containing password=AriesSerenaCairryNativitaMegan
  • HTTP requests with parameter Pu (new user password)
  • Rapid device reboots (multiple within minutes)
• Host:
  • Firmware binary containing the string AriesSerenaCairryNativitaMegan at offsets 0x803cdd0f and 0x803da3e6
  • Unauthorized changes to user passwords
• Logs:
  • Authentication logs showing successful login with the hard-coded password
  • System logs indicating unexpected reboots

Detection Engineering

YARA Rule

rule CVE_2024_31151_Hardcoded_Credential {
    meta:
        description = "Detects hard-coded credential string in LevelOne WBR-6012 firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-31151"
    strings:
        $cred = "AriesSerenaCairryNativitaMegan"
    condition:
        $cred
}

Sigma Rule

title: CVE-2024-31151 Hard-Coded Credential Exploitation
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests containing the hard-coded password for LevelOne WBR-6012
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'password=AriesSerenaCairryNativitaMegan'
    condition: selection
falsepositives:
    - None expected
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-31151 Hard-Coded Credential Attempt"; flow:to_server; content:"POST"; http_method; content:"password=AriesSerenaCairryNativitaMegan"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Devices: Place LevelOne WBR-6012 routers on a separate VLAN with strict access controls.
2. Disable Remote Management: Block port 80/443 from external networks.
3. Monitor for Reboots: Implement logging to detect unexpected device reboots.
4. Apply Workaround: If possible, use a firewall to block HTTP POST requests containing the hard-coded password string.

Long-Term Fix:

• Vendor Patch: No patch is available. Contact LevelOne for an update or consider replacing the device.
• Firmware Modification: Advanced users can reverse-engineer the firmware and remove the hard-coded credential, but this voids warranty and may brick the device.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defensive purposes only.