CVE-2024-29071 Overview
CVE-2024-29071 is a weak credentials vulnerability affecting the HGW BL1500HM home gateway device running firmware version 002.001.013 and earlier. The device ships with weak authentication material that a network-adjacent attacker can leverage without prior authentication. Successful exploitation allows the attacker to change system settings on the device, undermining confidentiality, integrity, and availability of the gateway. The weakness is classified under [CWE-1391] (Use of Weak Credentials) and [CWE-522] (Insufficiently Protected Credentials). The gateway is distributed as customer premises equipment through Japanese carrier channels, placing it directly on subscriber networks.
Critical Impact
A network-adjacent unauthenticated attacker can modify system settings on the HGW BL1500HM, gaining control over gateway configuration and potentially the traffic that traverses it.
Affected Products
- HGW BL1500HM firmware version 002.001.013
- HGW BL1500HM firmware versions earlier than 002.001.013
- Devices distributed via the AU modem program (see AU Modem Firmware Update Guide)
Discovery Timeline
- 2024-03-25 - CVE-2024-29071 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-29071
Vulnerability Analysis
The HGW BL1500HM gateway uses weak credentials to gate administrative functionality. An attacker positioned on the adjacent network, such as the local LAN or Wi-Fi segment, can authenticate or bypass authentication against the management interface without prior access. Once past this weak barrier, the attacker can change device settings that govern routing, DNS, remote management, and other network behavior. The impact extends beyond the device itself because the gateway sits between subscriber endpoints and the internet. Manipulated settings can redirect traffic, disable protections, or establish persistence for downstream attacks.
Root Cause
The root cause maps to two related weaknesses. [CWE-1391] describes the use of weak credentials such as default or predictable passwords in a product. [CWE-522] describes credentials that are stored or transmitted without adequate protection. Together they indicate that the gateway relies on authentication material an attacker can obtain, guess, or reuse to reach privileged configuration endpoints.
Attack Vector
The attack vector is Adjacent Network, meaning the attacker must share a network segment with the device but does not need credentials, user interaction, or elevated privileges. A rogue client on the LAN, a compromised endpoint, or a guest on the Wi-Fi network can reach the management interface. From there, the attacker submits configuration changes over the exposed protocol used by the gateway. No verified public exploit code is available for CVE-2024-29071 at the time of writing. Refer to the JVN Vulnerability Report and KDDI Technical Appendix for vendor technical details.
Detection Methods for CVE-2024-29071
Indicators of Compromise
- Unexpected changes to gateway configuration such as DNS servers, static routes, port forwarding rules, or remote management state.
- New or modified administrative accounts on the device management interface.
- Authentication attempts against the gateway originating from client devices that should not access the management plane.
Detection Strategies
- Compare current running configuration of the HGW BL1500HM against a known-good baseline and alert on drift.
- Monitor LAN-side traffic to the gateway management interface and flag connections from non-administrative hosts.
- Correlate DHCP, ARP, and Wi-Fi association logs with any successful management sessions to identify unauthorized adjacent-network actors.
Monitoring Recommendations
- Enable and centralize gateway logs, including authentication and configuration change events, in a SIEM or data lake.
- Alert on outbound DNS traffic bypassing the resolver configured by policy, which can indicate DNS hijacking via tampered gateway settings.
- Track firmware version reporting across the fleet to identify devices still running 002.001.013 or earlier.
How to Mitigate CVE-2024-29071
Immediate Actions Required
- Update HGW BL1500HM firmware to the fixed version distributed by the vendor as described in the AU Modem Firmware Update Guide.
- Change any administrative credentials on the device after updating, and avoid reusing prior passwords.
- Restrict access to the LAN and Wi-Fi segments that can reach the gateway management interface, especially guest networks.
Patch Information
KDDI and the device operator have published firmware updates that address the weak credentials issue. Consult the JVN Vulnerability Report for the authoritative advisory and the KDDI Technical Appendix for the fixed version details. Apply the update on every affected HGW BL1500HM unit.
Workarounds
- Isolate the gateway management interface on a dedicated VLAN accessible only from trusted administrative hosts.
- Disable Wi-Fi guest access or place guest clients on an isolated SSID with client isolation enabled to reduce adjacent-network exposure.
- Disable any remote management features on the gateway if they are not required for operations.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
