CVE-2024-23309
Level1 Wbr-6012 Firmware r0.40e6
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2024-23309 is a critical-severity Reliance on IP Address for Authentication (CWE-291) vulnerability in Level1 Wbr-6012 Firmware. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Junk Data (T1001.001); ranked in the top 41% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to IA-2 (Identification and Authentication (Organizational Users)) and IA-8 (Identification and Authentication (Non-organizational Users)) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34425
Vulnerability Data
The LevelOne WBR-6012 router with firmware R0.40e6 has an authentication bypass vulnerability in its web application due to reliance on client IP addresses for authentication. Attackers could spoof an IP address to gain unauthorized access without needing a session token.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires unique identification and authentication of users rather than permitting unauthenticated or spoofable attributes such as source IP.
Requires unique identification and authentication of non-organizational users, precluding reliance on IP address alone.
Mandates documented usage restrictions and configuration requirements for remote access that cannot be satisfied by IP-based authentication.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Network monitoring can detect misuse of IP authentication but does not prevent the weakness.
Managed identities and credentials supplant weak IP-based authentication decisions.
Strong authentication mechanisms directly replace reliance on spoofable IP addresses.
Authorization policies and least privilege reduce dependence on network-location assertions.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 only requires defining a topic-specific access control policy and determining requirements; it does not itself enforce, implement or prevent exploitation of IP-based authentication (a technical flaw that can still be exploited even with a policy in place).
A.5.16 manages the lifecycle, uniqueness, and accountability of identities; it has no bearing on whether a product trusts an IP address as an authenticator, so the weakness remains present and exploitable.
Authentication-information rules discourage reliance on mutable attributes such as IP addresses.
A.5.18 governs the provisioning, review, and revocation of access rights granted to already-authenticated identities; it has no bearing on whether an IP address is used as (or in lieu of) an authentication mechanism, so the weakness can still be present and exploited.
A.8.2 controls the allocation, review, expiry and use of privileged rights via authorization and least-privilege rules; it has no bearing on whether a product accepts an IP address as an authenticator, so the weakness can still be present and exploited.