Description

CVE-2024-29071 is a vulnerability in HGW BL1500HM Ver 002.001.013 and earlier that allows a network-adjacent unauthenticated attacker to change the system settings due to the use of weak credentials. The SVRS for this CVE is 30, indicating a moderate risk.

Key Insights

• Weak Credentials: The vulnerability is caused by the use of weak credentials, which makes it easy for attackers to gain access to the system.
• Remote Exploitation: The vulnerability can be exploited remotely, allowing attackers to target systems from anywhere with an internet connection.
• System Settings Modification: Attackers can use this vulnerability to change the system settings, which could give them control over the device.

Mitigation Strategies

• Update Firmware: Update the firmware to the latest version to patch the vulnerability.
• Change Credentials: Change the default credentials to strong, unique passwords.
• Enable Two-Factor Authentication: Enable two-factor authentication to add an extra layer of security.
• Monitor Network Traffic: Monitor network traffic for suspicious activity and block any unauthorized access attempts.

Additional Information

• Threat Actors/APT Groups: No specific threat actors or APT groups have been identified as actively exploiting this vulnerability.
• Exploit Status: Active exploits have been published.
• CISA Warnings: The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.
• In The Wild: The vulnerability is actively exploited by hackers.

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.