CVE-2024-24777: high-severity vulnerability in LevelOne WBR-6012
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
A weakness in the LevelOne WBR-6012 router allows attackers to trick users into performing unwanted actions through a malicious webpage. This happens because the device doesn't properly verify that requests actually come from the user.
CSRF vulnerability in LevelOne WBR-6012 R0.40e6 web application lacks proper request origin validation. Attack vector involves social engineering to lure authenticated users to a malicious website that crafts HTTP requests to the router, potentially leading to unauthorized configuration changes or administrative actions due to missing CSRF tokens or SameSite protections.
In the same product, most dangerous first.