CVE-2024-33626
📋 TL;DR
The LevelOne WBR-6012 router has an information disclosure vulnerability where unauthenticated attackers can access a hidden web page that reveals the WiFi WPS PIN. This allows attackers to connect to the WiFi network without authorization. All users of this router model are affected.
💻 Affected Systems
- LevelOne WBR-6012
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized WiFi access, potentially enabling man-in-the-middle attacks, network reconnaissance, and further exploitation of connected devices.
Likely Case
Local attackers within WiFi range connect to the network without credentials, potentially accessing shared resources or launching attacks against other devices.
If Mitigated
With proper network segmentation and monitoring, impact is limited to isolated network segments with no critical systems exposed.
🎯 Exploit Status
Exploitation requires only HTTP GET request to specific hidden URL. No authentication or special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
1. Check vendor website for firmware updates
2. If update available, download and install via router web interface
3. Reset router to factory settings after update
4. Change all default credentials including WiFi password
🔧 Temporary Workarounds
Disable WPS
allTurn off WiFi Protected Setup feature to prevent PIN-based attacks
Network Segmentation
allIsolate router management interface from user network
🧯 If You Can't Patch
- Replace affected router with supported model
- Implement strict network access controls and monitoring
🔍 How to Verify
Check if Vulnerable:
Access http://[router-ip]/hidden_page.html (exact path from advisory) without authentication and check if WPS PIN is disclosedCheck Version:
Check router web interface under System Status or Administration sectionVerify Fix Applied:
Attempt to access the hidden page after firmware update - should return 404 or require authentication📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /hidden_page.html or similar unusual paths
- Failed authentication attempts followed by successful access to hidden pages
Network Indicators:
- Unusual HTTP requests to router management interface from unauthorized IPs
- Multiple connection attempts to router on port 80
SIEM Query:
source="router_logs" AND (url="*/hidden_page*" OR status=200 AND url CONTAINS "hidden")