CVE-2024-33699 CRITICAL

CVE-2024-33699

Vendor Levelone

Product WBR-6012

Weakness CWE-620 · Unverified password change

Published October 30, 2024

Last update October 30, 2024

View on NVD All CVEs

CVSS base score

9.9/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

The LevelOne WBR-6012 router's web application has a vulnerability in its firmware version R0.40e6, allowing attackers to change the administrator password and gain higher privileges without the current password.

Key dates

02Disclosure timeline

October 30, 2024 CVE published

October 30, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-33699 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/620.html

Related vulnerabilities

04Related CVE

CVE-2025-62425 Matrix Authentication Service account password can be changed using an authenticated session without supplying the current password CVE-2025-67719 Ibexa User Bundle is missing password change validation CVE-2024-12827 DWT - Directory & Listing WordPress Theme <= 3.3.6 - Unauthenticated Arbitrary User Password Reset CVE-2025-4552 ContiNew Admin password unverified password change CVE-2025-4903 D-Link DI-7003GV2 webgl.asp sub_41F4F0 unverified password change