CVE-2025-1143 - Vulnerability Details - OpenCVE

Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Billion Electric	M120n

No data.

No data.

References

Link	Providers
https://www.twcert.org.tw/en/cp-139-8414-096ce-2.html
https://www.twcert.org.tw/tw/cp-132-8413-ec9a5-1.html

History

Fri, 11 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.0002}`	epss `{'score': 0.00022}`

Tue, 11 Feb 2025 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 11 Feb 2025 03:30:00 +0000

Type	Values Removed	Values Added
Description		Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.
Title		Billion Electric M120N - Use of Hard-coded Credentials
Weaknesses		CWE-798
References		https://www.twcert.org.tw/en/cp-139-8414-096ce-2.html https://www.twcert.org.tw/tw/cp-132-8413-ec9a5-1.html
Metrics		cvssV3_1 `{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

MITRE

Status: PUBLISHED

Assigner: twcert

Published: 2025-02-11T03:17:22.510Z

Updated: 2025-02-18T18:00:30.733Z

Reserved: 2025-02-10T01:51:06.133Z

Link: CVE-2025-1143

Vulnrichment

Updated: 2025-02-11T05:24:47.494Z

NVD

Status : Awaiting Analysis

Published: 2025-02-11T04:15:08.163

Modified: 2025-02-18T18:15:29.750

Link: CVE-2025-1143

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1143", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "state": "PUBLISHED", "assignerShortName": "twcert", "dateReserved": "2025-02-10T01:51:06.133Z", "datePublished": "2025-02-11T03:17:22.510Z", "dateUpdated": "2025-02-18T18:00:30.733Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "M100", "vendor": "Billion Electric", "versions": [{"lessThan": "1.04.1.592.10", "status": "affected", "version": "1.04.1.159.*", "versionType": "custom"}, {"lessThan": "1.04.1.613.14", "status": "affected", "version": "1.04.1.613.*", "versionType": "custom"}, {"lessThan": "1.04.1.676", "status": "affected", "version": "1.04.1.*", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "M150", "vendor": "Billion Electric", "versions": [{"lessThan": "1.04.1.592.10", "status": "affected", "version": "1.04.1.592.*", "versionType": "custom"}, {"lessThan": "1.04.1.613.14", "status": "affected", "version": "1.04.1.613.*", "versionType": "custom"}, {"lessThan": "1.04.1.676", "status": "affected", "version": "1.04.1.*", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "M120N", "vendor": "Billion Electric", "versions": [{"lessThan": "1.04.1.592.10", "status": "affected", "version": "1.04.1.592.*", "versionType": "custom"}, {"lessThan": "1.04.1.613.14", "status": "affected", "version": "1.04.1.613.*", "versionType": "custom"}, {"lessThan": "1.04.1.676", "status": "affected", "version": "1.04.1.*", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "M500", "vendor": "Billion Electric", "versions": [{"lessThan": "1.04.1.592.10", "status": "affected", "version": "1.04.1.592.*", "versionType": "custom"}, {"lessThan": "1.04.1.613.14", "status": "affected", "version": "1.04.1.613.*", "versionType": "custom"}, {"lessThan": "1.04.1.676", "status": "affected", "version": "1.04.1.*", "versionType": "custom"}]}], "datePublic": "2025-02-11T02:54:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system."}], "value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system."}], "impacts": [{"capecId": "CAPEC-191", "descriptions": [{"lang": "en", "value": "CAPEC-191 Read Sensitive Constants Within an Executable"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2025-02-11T03:17:22.510Z"}, "references": [{"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/tw/cp-132-8413-ec9a5-1.html"}, {"tags": ["third-party-advisory"], "url": "https://www.twcert.org.tw/en/cp-139-8414-096ce-2.html"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.<br>For firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.<br>For all other firmware version 1.04.1.x, please update to 1.04.1.676 or later.<br>"}], "value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.676 or later."}], "source": {"advisory": "TVN-202502001", "discovery": "EXTERNAL"}, "title": "Billion Electric M120N - Use of Hard-coded Credentials", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-02-11T05:24:10.391075Z", "id": "CVE-2025-1143", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-18T18:00:30.733Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1143", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-11T05:24:10.391075Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-11T05:24:47.494Z"}}], "cna": {"title": "Billion Electric M120N - Use of Hard-coded Credentials", "source": {"advisory": "TVN-202502001", "discovery": "EXTERNAL"}, "impacts": [{"capecId": "CAPEC-191", "descriptions": [{"lang": "en", "value": "CAPEC-191 Read Sensitive Constants Within an Executable"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Billion Electric", "product": "M100", "versions": [{"status": "affected", "version": "1.04.1.159.*", "lessThan": "1.04.1.592.10", "versionType": "custom"}, {"status": "affected", "version": "1.04.1.613.*", "lessThan": "1.04.1.613.14", "versionType": "custom"}, {"status": "affected", "version": "1.04.1.*", "lessThan": "1.04.1.676", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Billion Electric", "product": "M150", "versions": [{"status": "affected", "version": "1.04.1.592.*", "lessThan": "1.04.1.592.10", "versionType": "custom"}, {"status": "affected", "version": "1.04.1.613.*", "lessThan": "1.04.1.613.14", "versionType": "custom"}, {"status": "affected", "version": "1.04.1.*", "lessThan": "1.04.1.676", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Billion Electric", "product": "M120N", "versions": [{"status": "affected", "version": "1.04.1.592.*", "lessThan": "1.04.1.592.10", "versionType": "custom"}, {"status": "affected", "version": "1.04.1.613.*", "lessThan": "1.04.1.613.14", "versionType": "custom"}, {"status": "affected", "version": "1.04.1.*", "lessThan": "1.04.1.676", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Billion Electric", "product": "M500", "versions": [{"status": "affected", "version": "1.04.1.592.*", "lessThan": "1.04.1.592.10", "versionType": "custom"}, {"status": "affected", "version": "1.04.1.613.*", "lessThan": "1.04.1.613.14", "versionType": "custom"}, {"status": "affected", "version": "1.04.1.*", "lessThan": "1.04.1.676", "versionType": "custom"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.\nFor firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.\nFor all other firmware version 1.04.1.x, please update to 1.04.1.676 or later.", "supportingMedia": [{"type": "text/html", "value": "For firmware version 1.04.1.592.x, please update to 1.04.1.592.10 or later.<br>For firmware version 1.04.1.613.x, please update to 1.04.1.613.14 or later.<br>For all other firmware version 1.04.1.x, please update to 1.04.1.676 or later.<br>", "base64": false}]}], "datePublic": "2025-02-11T02:54:00.000Z", "references": [{"url": "https://www.twcert.org.tw/tw/cp-132-8413-ec9a5-1.html", "tags": ["third-party-advisory"]}, {"url": "https://www.twcert.org.tw/en/cp-139-8414-096ce-2.html", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.", "supportingMedia": [{"type": "text/html", "value": "Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "shortName": "twcert", "dateUpdated": "2025-02-11T03:17:22.510Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1143", "state": "PUBLISHED", "dateUpdated": "2025-02-18T18:00:30.733Z", "dateReserved": "2025-02-10T01:51:06.133Z", "assignerOrgId": "cded6c7f-6ce5-4948-8f87-aa7a3bbb6b0e", "datePublished": "2025-02-11T03:17:22.510Z", "assignerShortName": "twcert"}, "dataVersion": "5.1"}