Billion Electric Routers Hard-Coded Credentials Vulnerability Allowing Root Access via SSH

A vulnerability exists in certain Billion Electric router models, including the M100, M150, M120N, and M500. These routers have hard-coded Linux credentials that can be used to log in through the SSH service, granting root privileges on the system.

Impact

Exploitation of this vulnerability allows for unauthorized SSH access with root privileges on the affected router models.

Remediation

Users with routers on firmware version 1.04.1.592.x should update to version 1.04.1.592.10 or later. Those on version 1.04.1.613.x should update to 1.04.1.613.14 or later. For all other versions in the 1.04.1.x range, users should update to 1.04.1.676 or later.