CVE-2025-1143: Billion Electric M120N - Use of Hard-coded Credentials

Severity: high (CVSS 8.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-11 · updated 2026-06-17
Weakness: CWE-798

Description

Certain models of routers from Billion Electric has hard-coded embedded linux credentials, allowing attackers to log in through the SSH service using these credentials and obtain root privilege of the system.

Affected products

Billion Electric M100: from 1.04.1.159.* before 1.04.1.592.10; from 1.04.1.613.* before 1.04.1.613.14; from 1.04.1.* before 1.04.1.676 — fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676
Billion Electric M120N: from 1.04.1.592.* before 1.04.1.592.10; from 1.04.1.613.* before 1.04.1.613.14; from 1.04.1.* before 1.04.1.676 — fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676
Billion Electric M150: from 1.04.1.592.* before 1.04.1.592.10; from 1.04.1.613.* before 1.04.1.613.14; from 1.04.1.* before 1.04.1.676 — fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676
Billion Electric M500: from 1.04.1.592.* before 1.04.1.592.10; from 1.04.1.613.* before 1.04.1.613.14; from 1.04.1.* before 1.04.1.676 — fixed in 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676

How to fix

Upgrade to a fixed version: Billion Electric M100 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676; Billion Electric M120N 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676; Billion Electric M150 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676; Billion Electric M500 1.04.1.592.10, 1.04.1.613.14, 1.04.1.676. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2025-1143 or the next vulnerability affects your stack