Read the docs
TI-2025-00968 Aliases CVE-2025-1143

Billion Electric M120N - Use of Hard-coded Credentials

Priority LOW 38CWE-798Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-798.

Summary

Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00189 8th percentileScored 2026-11-07
Fix Fixed M100 (Billion Electric): 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676M150 (Billion Electric): 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Billion ElectricM100before 1.04.1.592.10; before 1.04.1.613.14; before 1.04.1.6761.04.1.592.10, 1.04.1.613.14, 1.04.1.676Patch availableCNA
Billion ElectricM150before 1.04.1.592.10; before 1.04.1.613.14; before 1.04.1.6761.04.1.592.10, 1.04.1.613.14, 1.04.1.676Patch availableCNA
Billion ElectricM120Nbefore 1.04.1.592.10; before 1.04.1.613.14; before 1.04.1.6761.04.1.592.10, 1.04.1.613.14, 1.04.1.676Patch availableCNA
Billion ElectricM500before 1.04.1.592.10; before 1.04.1.613.14; before 1.04.1.6761.04.1.592.10, 1.04.1.613.14, 1.04.1.676Patch availableCNA
  • M100 VendorBillion Electric Affected before 1.04.1.592.10; before 1.04.1.613.14; before 1.04.1.676 Fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676 Patch available CNA
  • M150 VendorBillion Electric Affected before 1.04.1.592.10; before 1.04.1.613.14; before 1.04.1.676 Fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676 Patch available CNA
  • M120N VendorBillion Electric Affected before 1.04.1.592.10; before 1.04.1.613.14; before 1.04.1.676 Fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676 Patch available CNA
  • M500 VendorBillion Electric Affected before 1.04.1.592.10; before 1.04.1.613.14; before 1.04.1.676 Fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676 Patch available CNA

Remediation

  • Fix · CNA M100 (Billion Electric) Fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676
  • Fix · CNA M150 (Billion Electric) Fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676
  • Fix · CNA M120N (Billion Electric) Fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676
  • Fix · CNA M500 (Billion Electric) Fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1143

References

Advisory 2

  • TI-2024-11116 Billion Electric router - Missing Authentication CVSS 3.1HIGH 8.6
  • TI-2024-11117 Billion Electric router - Authentication Bypass CVSS 3.1HIGH 7.5
  • TI-2024-11119 Billion Electric router - OS Command Injection CVSS 3.1HIGH 7.2
  • TI-2024-11118 Billion Electric router - Plaintext Storage of a Password CVSS 3.1HIGH 7.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences