CVE-2024-24777: Level1 WBR-6012 Firmware CSRF Vulnerability

CVE-2024-24777 Overview

CVE-2024-24777 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Web Application functionality of the LevelOne WBR-6012 wireless router running firmware R0.40e6. An attacker who convinces an authenticated administrator to visit a malicious web page can issue unauthorized requests to the router, leading to configuration changes and unauthorized access.

The issue affects the router's HTTP management interface, which does not validate the origin or authenticity of state-changing requests. Talos Intelligence published the technical advisory tracking this issue as TALOS-2024-1981.

Critical Impact
A successful attack lets a remote actor modify router settings, pivot into the internal network, or disrupt connectivity by abusing the active session of an authenticated user.

Affected Products

LevelOne WBR-6012 router (hardware revision R0)
LevelOne WBR-6012 firmware version R0.40e6
Web Application management interface on the device

Discovery Timeline

2024-10-30 - CVE-2024-24777 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-24777

Vulnerability Analysis

The WBR-6012 web management interface processes administrative HTTP requests without verifying that the request was intentionally issued by the authenticated user. The application relies solely on session state for authorization and omits anti-CSRF tokens, Origin/Referer validation, or SameSite cookie protections.

An attacker hosts a crafted page containing HTML form submissions or JavaScript-driven HTTP requests targeting the router's administrative endpoints. When an authenticated administrator visits the attacker's page from the same browser, the browser automatically attaches the active session cookie. The router accepts the forged request as legitimate and executes the requested change.

The impact spans confidentiality, integrity, and availability because router configuration controls DNS, routing, firewall rules, and remote management settings. Exploitation requires user interaction but no privileges on the attacker side.

Root Cause

The root cause is missing CSRF protection on state-changing HTTP endpoints in the router's web application. The handlers do not require an unpredictable per-session token, do not validate the request Origin header, and rely on ambient cookie authentication.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker stages a malicious web page or injects malicious content into a site the administrator is likely to visit. When the administrator has an active session with the router's web interface, the malicious page submits forged requests to the router's LAN IP address. No credentials are needed by the attacker because the browser supplies them automatically.

No verified public exploit code is available. Refer to the Talos Intelligence Vulnerability Report TALOS-2024-1981 for technical reproduction details.

Detection Methods for CVE-2024-24777

Indicators of Compromise

Unexpected configuration changes on the router such as modified DNS servers, new port forwarding rules, or altered firewall policies
HTTP POST requests to the router's admin interface with Referer headers pointing to external or unfamiliar domains
Administrative actions logged outside of normal maintenance windows
New or altered remote management settings enabling WAN-side access

Detection Strategies

Inspect HTTP traffic to the router management interface for requests whose Origin or Referer headers do not match the router's own hostname or LAN address
Compare periodic snapshots of router configuration against a known-good baseline to surface unauthorized changes
Monitor browser proxy or network logs for cross-origin requests targeting RFC1918 router addresses immediately after a user visits an external site

Monitoring Recommendations

Forward router syslog events to a centralized logging platform and alert on configuration write operations
Track DNS resolver settings on client devices for unexpected changes that would indicate router DNS hijacking
Review web proxy logs for sessions that load attacker-controlled content followed by requests to internal management URLs

How to Mitigate CVE-2024-24777

Immediate Actions Required

Restrict access to the router's web administration interface to a dedicated management VLAN or specific trusted hosts
Disable remote (WAN-side) management on the WBR-6012 until a vendor fix is available
Log out of the router's web interface immediately after each administrative session to invalidate the cookie that CSRF abuses
Use a separate browser or browser profile when administering the router so general browsing sessions cannot reach the management UI

Patch Information

No vendor patch is referenced in the published CVE data. Monitor the Talos Intelligence Vulnerability Report TALOS-2024-1981 and the LevelOne support site for firmware updates superseding R0.40e6. If the device is end-of-life or no fix is forthcoming, plan replacement with a supported router that implements CSRF protections.

Workarounds

Change the router's default LAN IP to a non-standard address to reduce reliability of blind CSRF payloads targeting common addresses such as 192.168.1.1
Enforce browser extensions or policies that block cross-origin requests to RFC1918 addresses from public websites
Require administrators to clear cookies or use private browsing windows dedicated to router management
Place the router management interface behind a VPN so the web UI is unreachable from a browser session used for general web browsing

bash

# Example: restrict router admin access to a single management host using an upstream firewall
iptables -A FORWARD -p tcp -d <router-lan-ip> --dport 80 -s <admin-workstation-ip> -j ACCEPT
iptables -A FORWARD -p tcp -d <router-lan-ip> --dport 80 -j DROP