CVE-2024-11980

HighCVSS 8.6/10Last modified Jun 17, 2026

Description

Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.

Metrics

CVSS 3.1 8.6/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H

Weakness enumeration

CWE-306

Affected software

Vendor	Product	Versions
Billion Electric	M100	>= 1.04.1.592., < 1.04.1.592.8; >= 1.04.1.613., < 1.04.613.13; >= 1.04.1.*, < 1.04.1.675
Billion Electric	M150	>= 1.04.1.592., < 1.04.1.592.8; >= 1.04.1.613., < 1.04.613.13; >= 1.04.1.*, < 1.04.1.675
Billion Electric	M120N	>= 1.04.1.592., < 1.04.1.592.8; >= 1.04.1.613., < 1.04.613.13; >= 1.04.1.*, < 1.04.1.675
Billion Electric	M500	>= 1.04.1.592., < 1.04.1.592.8; >= 1.04.1.613., < 1.04.613.13; >= 1.04.1.*, < 1.04.1.675
billion_electric	m150	>= 1.04.1.592., < 1.04.1.592.8; >= 1.04.1.613., < 1.04.613.13; >= 1.04.1.* <, < 1.04.1.675
billion_electric	m150	>= 1.04.1.592., < 1.04.1.592.8; >= 1.04.1.613., < 1.04.613.13; >= 1.04.1.* <, < 1.04.1.675
billion_electric	m120n	>= 1.04.1.592., < 1.04.1.592.8; >= 1.04.1.613., < 1.04.613.13; >= 1.04.1.* <, < 1.04.1.675
billion_electric	m500	>= 1.04.1.592., < 1.04.1.592.8; >= 1.04.1.613., < 1.04.613.13; >= 1.04.1.* <, < 1.04.1.675

References

Timeline

Published: Nov 29, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-119817.5Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive con CVE-2024-119827.2Certain models of routers from Billion Electric has a Plaintext Storage of a Password vulnerability. Remote attackers with administrator pri CVE-2024-119837.2Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator priv CVE-2024-119848.8A unrestricted upload of file with dangerous type vulnerability in epaper draft function in Corporate Training Management System before 10.1 CVE-2024-119854.4An improper input validation vulnerability leads to device crashes in certain ASUS router models. Refer to the '12/03/2024 ASUS Router Impr CVE-2024-119869.6Improper input handling in the 'Host Header' allows an unauthenticated attacker to store a payload in web application logs. When an Administ CVE-2024-11997.5A vulnerability has been found in CodeAstro Employee Task Management System 1.0 and classified as problematic. Affected by this vulnerabilit CVE-2024-119904.6A Cross-Site Scripting (XSS) vulnerability in SurgeMail v78c2 could allow an attacker to execute arbitrary JavaScript code via an elaborate CVE-2024-119916.5Motoko's incremental garbage collector is impacted by an uninitialized memory access bug, caused by incorrect use of write barriers in a few CVE-2024-119929.1Absolute path traversal vulnerability in Quick.CMS, version 6.7, the exploitation of which could allow remote users to bypass the intended r CVE-2024-119936.1Reflected cross-site scripting (XSS) vulnerability in Liferay Portal 7.4.0 through 7.4.3.38, and Liferay DXP 7.4 GA through update 38 allows CVE-2024-119945.7APM server logs could contain parts of the document body from a partially failed bulk index request. Depending on the nature of the document