CVE-2024-11983: Billion Electric router - OS Command Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-11-29 · updated 2026-06-17
Weakness: CWE-78

Description

Certain models of routers from Billion Electric has an OS Command Injection vulnerability, allowing remote attackers with administrator privileges to inject arbitrary system commands into a specific SSH function and execute them on the device.

Affected products

Billion Electric M100: from 1.04.1.592.* before 1.04.1.592.8; from 1.04.1.613.* before 1.04.1.613.13; from 1.04.1.* before 1.04.1.675 — fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675
Billion Electric M120N: from 1.04.1.592.* before 1.04.1.592.8; from 1.04.1.613.* before 1.04.1.613.13; from 1.04.1.* < before 1.04.1.675 — fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675
Billion Electric M150: from 1.04.1.592.* before 1.04.1.592.8; from 1.04.1.613.* before 1.04.1.613.13; from 1.04.1.* < before 1.04.1.675 — fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675
Billion Electric M500: from 1.04.1.592.* before 1.04.1.592.8; from 1.04.1.613.* before 1.04.1.613.13; from 1.04.1.* < before 1.04.1.675 — fixed in 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675

How to fix

Upgrade to a fixed version: Billion Electric M100 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675; Billion Electric M120N 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675; Billion Electric M150 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675; Billion Electric M500 1.04.1.592.8, 1.04.1.613.13, 1.04.1.675. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-11983 or the next vulnerability affects your stack