CVE-2024-51431
📋 TL;DR
LB-LINK BL-WR 1300H router firmware version 1.0.4 contains hardcoded credentials stored in the /etc/shadow file that are easily guessable. This allows attackers to gain administrative access to the router. All users of this specific router model and firmware version are affected.
💻 Affected Systems
- LB-LINK BL-WR 1300H
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the router allowing attackers to intercept all network traffic, modify DNS settings, install malware, and pivot to internal network devices.
Likely Case
Attackers gain administrative access to the router, enabling them to change network settings, monitor traffic, and potentially access connected devices.
If Mitigated
Limited impact if router is behind additional firewalls and network segmentation prevents lateral movement.
🎯 Exploit Status
The hardcoded credentials are easily guessable, making exploitation trivial. Public GitHub repository contains details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.lb-link.com/
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates. If update exists, download and flash via router admin interface.
🔧 Temporary Workarounds
Change Default Credentials
allManually change all default passwords and credentials on the router
Login to router admin interface > System Tools > Password
Disable Remote Management
allPrevent external access to router administration interface
Login to router admin interface > Security > Remote Management > Disable
🧯 If You Can't Patch
- Isolate router in separate VLAN with strict firewall rules
- Implement network monitoring for suspicious authentication attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version in admin interface. If version is 1.0.4, device is vulnerable.Check Version:
Check router web interface at 192.168.1.1 > Status > Firmware VersionVerify Fix Applied:
Verify firmware version has been updated beyond 1.0.4. Check /etc/shadow file for hardcoded credentials if SSH access is available.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful login with default credentials
- Configuration changes from unknown IP addresses
Network Indicators:
- Unusual outbound connections from router
- DNS hijacking patterns
- Unexpected port forwarding rules
SIEM Query:
source="router" AND (event_type="authentication" AND result="success" AND user="admin")