Read the docs
TI-2024-11116 Aliases CVE-2024-11980GHSA-cv6w-7hvv-mf8v

Billion Electric router - Missing Authentication

Priority MEDIUM 44CWE-306Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-306.

Summary

Certain modes of routers from Billion Electric have a Missing Authentication vulnerability, allowing unauthenticated remote attackers to directly access the specific functionality to obtain partial device information, modify the WiFi SSID, and restart the device.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0046 40th percentileScored 2026-11-07
Fix Fixed M100 (Billion Electric): 1.04.1.592.8, 1.04.613.13, 1.04.1.675M150 (Billion Electric): 1.04.1.592.8, 1.04.613.13, 1.04.1.675+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Billion ElectricM100before 1.04.1.592.8; before 1.04.613.13; before 1.04.1.6751.04.1.592.8, 1.04.613.13, 1.04.1.675Patch availableCNA
Billion ElectricM150before 1.04.1.592.8; before 1.04.613.13; before 1.04.1.6751.04.1.592.8, 1.04.613.13, 1.04.1.675Patch availableCNA
Billion ElectricM120Nbefore 1.04.1.592.8; before 1.04.613.13; before 1.04.1.6751.04.1.592.8, 1.04.613.13, 1.04.1.675Patch availableCNA
Billion ElectricM500before 1.04.1.592.8; before 1.04.613.13; before 1.04.1.6751.04.1.592.8, 1.04.613.13, 1.04.1.675Patch availableCNA
  • M100 VendorBillion Electric Affected before 1.04.1.592.8; before 1.04.613.13; before 1.04.1.675 Fixed in 1.04.1.592.8, 1.04.613.13, 1.04.1.675 Patch available CNA
  • M150 VendorBillion Electric Affected before 1.04.1.592.8; before 1.04.613.13; before 1.04.1.675 Fixed in 1.04.1.592.8, 1.04.613.13, 1.04.1.675 Patch available CNA
  • M120N VendorBillion Electric Affected before 1.04.1.592.8; before 1.04.613.13; before 1.04.1.675 Fixed in 1.04.1.592.8, 1.04.613.13, 1.04.1.675 Patch available CNA
  • M500 VendorBillion Electric Affected before 1.04.1.592.8; before 1.04.613.13; before 1.04.1.675 Fixed in 1.04.1.592.8, 1.04.613.13, 1.04.1.675 Patch available CNA

CPE names CISA-ADP · 3

CPEVersionsRoleVendor
cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*——Billion Electric
cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*——Billion Electric
cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*——Billion Electric
  • cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:* Versions — — ·Billion Electric
  • cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:* Versions — — ·Billion Electric
  • cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:* Versions — — ·Billion Electric

Remediation

  • Fix · CNA M100 (Billion Electric) Fixed in 1.04.1.592.8, 1.04.613.13, 1.04.1.675
  • Fix · CNA M150 (Billion Electric) Fixed in 1.04.1.592.8, 1.04.613.13, 1.04.1.675
  • Fix · CNA M120N (Billion Electric) Fixed in 1.04.1.592.8, 1.04.613.13, 1.04.1.675
  • Fix · CNA M500 (Billion Electric) Fixed in 1.04.1.592.8, 1.04.613.13, 1.04.1.675

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-11980
  2. 2026-10-03 Alias added: GHSA-cv6w-7hvv-mf8v

References

Advisory 2

  • TI-2024-11117 Billion Electric router - Authentication Bypass CVSS 3.1HIGH 7.5
  • TI-2025-00968 Billion Electric M120N - Use of Hard-coded Credentials CVSS 3.1HIGH 8.4
  • TI-2024-11119 Billion Electric router - OS Command Injection CVSS 3.1HIGH 7.2
  • TI-2024-11118 Billion Electric router - Plaintext Storage of a Password CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences