CVE-2024-33375

The router firmware does not apply any encryption or hashing mechanism to protect stored authentication data. A person who gains access to the firmware file — for example through extraction from flash memory, firmware image download, or another vulnerability on the same device — can read passwords in plaintext without needing to crack them. CWE-256 (Plaintext Storage of a Password) confirms the lack of any cryptographic protection of stored credentials.

An attacker can obtain complete authentication credentials for the router, leading to takeover of the device, modification of its network configuration, and potential lateral movement within the local network.

Patches available from the manufacturer should be applied according to references. Additionally, it is recommended to change all passwords configured on the device and restrict physical and network access to the router's management interface until the patch is deployed.

LB-LINK BL-W1210M Firmware version 2.0