CVE-2024-33375

Executive Summary

CVE-2024-33375 exposes a critical security flaw in the LB-LINK BL-W1210M v2.0 router, where user credentials (including administrative passwords) are stored in plaintext within the device firmware. This vulnerability allows an attacker with physical or remote access to the firmware to extract sensitive authentication data, leading to full device compromise and potential lateral movement within the network. The vulnerability is unpatched, and no official fix has been provided by the vendor.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware issue specific to the LB-LINK BL-W1210M router.

CVSS Breakdown & Threat Level

While no official CVSS vector is assigned, based on the nature of the vulnerability (plaintext credential storage), a reasonable assessment would be:

• Attack Vector (AV): Adjacent Network (physical or local network access to firmware)
• Attack Complexity (AC): Low
• Privileges Required (PR): None
• User Interaction (UI): None
• Scope (S): Changed (compromise of credentials can affect other systems)
• Confidentiality (C): High
• Integrity (I): High
• Availability (A): None

Estimated CVSS Score: 8.8 (High)

Threat Level: High – Credential exposure can lead to full device takeover and network compromise.

Deep Dive & Mechanics

The LB-LINK BL-W1210M v2.0 router stores user credentials (e.g., admin username/password, Wi-Fi passwords) in plaintext within the firmware image. This is typically found in configuration files or scripts that are not encrypted or hashed. An attacker can obtain the firmware via:

1. Physical Access: Dumping the firmware from the device’s flash memory using JTAG or UART.
2. Remote Exploitation: If the router has a firmware update mechanism that does not verify integrity, an attacker could download the firmware from the vendor’s server or intercept it in transit.
3. Network Sniffing: If credentials are transmitted in plaintext during login or configuration, they can be captured.

Once the firmware is extracted, tools like binwalk or firmware-mod-kit can be used to unpack it and locate the credential files (e.g., /etc/shadow, config.xml, or custom scripts). The plaintext credentials can then be used to log into the router’s web interface or SSH (if enabled).

Vulnerable vs. Patched Code

Vulnerable Code (Example from firmware):

# /etc/config/wireless
config wifi-iface
    option device 'radio0'
    option network 'lan'
    option mode 'ap'
    option ssid 'MyNetwork'
    option encryption 'psk2'
    option key 'my_plaintext_password'

Patched Code (Hypothetical):

# /etc/config/wireless
config wifi-iface
    option device 'radio0'
    option network 'lan'
    option mode 'ap'
    option ssid 'MyNetwork'
    option encryption 'psk2'
    option key '$2y$10$...'  # bcrypt hash

The vulnerable version stores the password in plaintext (my_plaintext_password), while a patched version would use a strong hash (e.g., bcrypt) and possibly encrypt the configuration file.

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Target: LB-LINK BL-W1210M v2.0 router
• Attacker machine: Kali Linux with binwalk, firmware-mod-kit, and strings
• Physical access to router (or firmware image)

Steps:

1. Obtain firmware image (e.g., via curl http://vendor.com/firmware.bin or dump via flashrom).
2. Extract firmware:

   binwalk -e firmware.bin
   

3. Search for plaintext credentials:

   strings _firmware.extracted/* | grep -i "password\|passwd\|key"
   

4. Locate configuration files (e.g., config.xml, shadow):

   find _firmware.extracted -name "*.xml" -o -name "shadow" -o -name "config"
   

5. Extract credentials and use them to log into the router’s web interface.

Exploit Code (Python script to parse firmware):

import sys
import re

def extract_credentials(firmware_path):
    with open(firmware_path, 'rb') as f:
        data = f.read()
    # Simple regex for plaintext passwords
    passwords = re.findall(rb'password[=:]\s*(\S+)', data, re.IGNORECASE)
    for pwd in passwords:
        print(f"Found password: {pwd.decode('utf-8', errors='ignore')}")

if __name__ == "__main__":
    extract_credentials(sys.argv[1])

Blue Team (Defender)

Detection:

• Monitor for unauthorized firmware dumps (e.g., via JTAG or UART).
• Use network monitoring to detect plaintext credential transmission.
• Implement firmware integrity checks (e.g., signed firmware updates).

Mitigation:

• Replace the router with a patched model or vendor-supported device.
• If replacement is not possible, isolate the router on a separate VLAN.
• Change default credentials immediately and use strong, unique passwords.
• Disable remote management if not needed.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – replace with actual hash if available)
  • firmware.bin: a1b2c3d4e5f6...
• Network Traffic:
  • Plaintext HTTP login requests to router IP (e.g., POST /cgi-bin/login with username=admin&password=plaintext)
• Firmware Artifacts:
  • Configuration files containing password=plaintext or key=plaintext
• Processes:
  • Unauthorized telnet or ssh sessions from unknown IPs

Detection Engineering

YARA Rule

rule CVE_2024_33375_Plaintext_Credentials {
    meta:
        description = "Detects plaintext credentials in LB-LINK BL-W1210M firmware"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-33375"
    strings:
        $password = /password[=:]\s*[^\s]{1,64}/ nocase
        $key = /key[=:]\s*[^\s]{1,64}/ nocase
        $passwd = /passwd[=:]\s*[^\s]{1,64}/ nocase
    condition:
        any of them
}

Sigma Rule

title: Detection of Plaintext Credentials in LB-LINK Router Firmware
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects plaintext credential storage in LB-LINK BL-W1210M firmware
author: Valters IT
date: 2025/04/10
logsource:
    category: file_event
    product: linux
detection:
    selection:
        TargetFilename|contains: 'firmware.bin'
        EventID: 11  # File creation
    condition: selection
falsepositives:
    - Legitimate firmware analysis
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-33375 - Plaintext Credential Transmission"; flow:to_server; content:"password"; nocase; content:"="; distance:0; within:100; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Change all router passwords (admin, Wi-Fi) immediately.
   • Disable remote management and unused services (e.g., telnet, SSH).
   • Update firmware if a patched version becomes available (check vendor website).

2. Long-term Fix:

   • Replace the router with a model from a vendor that provides security updates.
   • Implement network segmentation to isolate IoT devices.
   • Use a hardware firewall to monitor and block suspicious traffic.

3. Vendor Communication:

   • Contact LB-LINK to request a firmware update that encrypts credentials.
   • If no response, consider reporting to CERT/CC or other vulnerability disclosure programs.

Valters IT
Securing digital frontiers, one vulnerability at a time.