CVE-2024-24777
Published: 30 October 2024
Summary
CVE-2024-24777 is a high-severity CSRF (CWE-352) vulnerability in Level1 Wbr-6012 Firmware. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 5.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
A cross-site request forgery vulnerability, tracked as CVE-2024-24777 and assigned CWE-352, affects the web application functionality of the LevelOne WBR-6012 router running firmware R0.40e6. The flaw permits an attacker to submit specially crafted HTTP requests that execute actions within the device’s administrative interface without proper origin validation, carrying a CVSS 3.1 score of 8.8.
An unauthenticated remote attacker can exploit the issue by hosting a malicious web page that a logged-in administrator visits, resulting in unauthorized access with full confidentiality, integrity, and availability impact on the device. The attack requires user interaction via the browser but needs no other credentials or privileges.
The two referenced Talos reports detail the vulnerability but do not describe available patches or specific mitigation steps. The associated EPSS score has remained flat at 0.1364 with no observed rise since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-22156
Vulnerability details
A cross-site request forgery (CSRF) vulnerability exists in the Web Application functionality of the LevelOne WBR-6012 R0.40e6. A specially crafted HTTP request can lead to unauthorized access. An attacker can stage a malicious web page to trigger this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Awareness training educates users on avoiding untrusted links and actions that can be exploited via CSRF.
Requiring user re-entry of credentials for sensitive actions prevents automated forgery of requests without active user participation.
Security testing regimens explicitly include checks for missing or ineffective anti-CSRF protections in web applications.
Detects anomalous request patterns consistent with cross-site request forgery.