CVE-2024-51431

CRITICAL

LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.

Affects 2 products across 1 vendor.

BCS6.82
CVSS 3.19.8
EPSS0.6%
Percentile45th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-798: Use of Hard-Coded Credentials

Software contains embedded passwords or keys that cannot be changed by the administrator.

Related Attack Patterns (CAPEC)
CAPEC-70 Try Common or Default Usernames and Passwords
via CWE-798
CAPEC-191 Read Sensitive Constants Within an Executable
via CWE-798

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ SAGE Intelligence — CITED Relevance Research Team

The LB-LINK BL-WR 1300H v.1.0.4 device contains hardcoded credentials stored in /etc/shadow, which are easily guessable, posing a significant security risk.

BSID: BS-2024-GLOBAL-209503-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2024-51431?
The LB-LINK BL-WR 1300H v.1.0.4 device contains hardcoded credentials stored in /etc/shadow, which are easily guessable, posing a significant security risk.
What is the CVSS score for CVE-2024-51431?
CVE-2024-51431 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 0.6%.
Is CVE-2024-51431 actively exploited?
No confirmed active exploitation of CVE-2024-51431 as of 2026-05-30.
How do I remediate CVE-2024-51431?
Priority: IMMEDIATE.
What systems are affected by CVE-2024-51431?
CVE-2024-51431 affects: Lb-Link, Lb-Link.
Vulnerability Details
CVE IDCVE-2024-51431
BSIDBS-2024-GLOBAL-209503-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2024-11-01
Last Modified2024-11-05
ICS Relevance15%
Weakness (CWE)
Use of Hard-Coded Credentials
SourceNVD
Official Description

LB-LINK BL-WR 1300H v.1.0.4 contains hardcoded credentials stored in /etc/shadow which are easily guessable.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

An attacker can exploit the hardcoded credentials to gain unauthorized access to the device's administrative interface, potentially leading to full control over the device and the network it is connected to.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductFixed Version
Lb-Link Bl-Wr1300H Firmware —
Lb-Link Bl-Wr1300H —
Remediation

No patch URL on record. Monitor vendor security advisories directly.

Threat Intelligence
● Threat Intelligence Validated: September 2026 | Threat Age: 669 Days
CISA KEVNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
SAGE Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash149cbd4725d4190e3f496faaac6d42cda00807a7fbf37572c3aba137973b0dafbcd1b3aa33001aad5569cfc59c146c379c0581e9cf44edbc2319717e05014c93
Related CVEs affecting Lb-Link
CVE-2025-1609 9.8 A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified ... CVE-2023-26801 9.8 LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5... CVE-2024-33375 9.8 LB-LINK BL-W1210M v2.0 was discovered to store user credentials in plaintext ... CVE-2025-1608 9.8 A vulnerability, which was classified as critical, was found in LB-LINK AC190... CVE-2025-1610 9.8 A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as cr...
View all Lb-Link CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Check Your Assets Free →