Read the docs
TI-2024-11117 Aliases CVE-2024-11981GHSA-2r3m-26p3-wr26

Billion Electric router - Authentication Bypass

Priority MEDIUM 40CWE-288Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-288.

Summary

Certain models of routers from Billion Electric has an Authentication Bypass vulnerability, allowing unautheticated attackers to retrive contents of arbitrary web pages.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00541 45th percentileScored 2026-11-07
Fix Fixed M100 (Billion Electric): 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675M150 (Billion Electric): 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Billion ElectricM100before 1.04.1.592.8; before 1.04.1.613.13; before 1.04.1.6751.04.1.592.8, 1.04.1.613.13, 1.04.1.675Patch availableCNA
Billion ElectricM150before 1.04.1.592.8; before 1.04.1.613.13; before 1.04.1.6751.04.1.592.8, 1.04.1.613.13, 1.04.1.675Patch availableCNA
Billion ElectricM120Nbefore 1.04.1.592.8; before 1.04.1.613.13; before 1.04.1.6751.04.1.592.8, 1.04.1.613.13, 1.04.1.675Patch availableCNA
Billion ElectricM500before 1.04.1.592.8; before 1.04.1.613.13; before 1.04.1.6751.04.1.592.8, 1.04.1.613.13, 1.04.1.675Patch availableCNA
  • M100 VendorBillion Electric Affected before 1.04.1.592.8; before 1.04.1.613.13; before 1.04.1.675 Fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675 Patch available CNA
  • M150 VendorBillion Electric Affected before 1.04.1.592.8; before 1.04.1.613.13; before 1.04.1.675 Fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675 Patch available CNA
  • M120N VendorBillion Electric Affected before 1.04.1.592.8; before 1.04.1.613.13; before 1.04.1.675 Fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675 Patch available CNA
  • M500 VendorBillion Electric Affected before 1.04.1.592.8; before 1.04.1.613.13; before 1.04.1.675 Fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675 Patch available CNA

CPE names CISA-ADP · 4

CPEVersionsRoleVendor
cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:*——Billion Electric
cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:*——Billion Electric
cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:*——Billion Electric
cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:*——Billion Electric
  • cpe:2.3:a:billion_electric:m100:*:*:*:*:*:*:*:* Versions — — ·Billion Electric
  • cpe:2.3:a:billion_electric:m150:*:*:*:*:*:*:*:* Versions — — ·Billion Electric
  • cpe:2.3:a:billion_electric:m120n:*:*:*:*:*:*:*:* Versions — — ·Billion Electric
  • cpe:2.3:a:billion_electric:m500:*:*:*:*:*:*:*:* Versions — — ·Billion Electric

Remediation

  • Fix · CNA M100 (Billion Electric) Fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675
  • Fix · CNA M150 (Billion Electric) Fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675
  • Fix · CNA M120N (Billion Electric) Fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675
  • Fix · CNA M500 (Billion Electric) Fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Billion Electric M100, M120N and 2 more products 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675

    3 records Highest priority Priority MEDIUM 1 MEDIUM, 2 LOW

    Other records, highest priority first

    • TI-2024-11119 Billion Electric router - OS Command InjectionPriority LOW 36
    • TI-2024-11118 Billion Electric router - Plaintext Storage of a PasswordPriority LOW 35
    Show all 3 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-11981
  2. 2026-10-03 Alias added: GHSA-2r3m-26p3-wr26

References

Advisory 2

  • TI-2024-11116 Billion Electric router - Missing Authentication CVSS 3.1HIGH 8.6
  • TI-2025-00968 Billion Electric M120N - Use of Hard-coded Credentials CVSS 3.1HIGH 8.4
  • TI-2024-11119 Billion Electric router - OS Command Injection CVSS 3.1HIGH 7.2
  • TI-2024-11118 Billion Electric router - Plaintext Storage of a Password CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences