CVE-2023-49593

The LevelOne WBR-6013 ships with leftover debug code in the boa web server's formSysCmd functionality, and a specially crafted network request routed to it results in arbitrary command execution on the device. This is a debug backdoor left in production firmware — functionally a command-execution primitive on the router — but the vector marks it as requiring high privileges, so it isn't an anonymous-anyone path.

That privilege precondition shapes the ranking. The realistic abuser is someone who already holds elevated access to the device — an authenticated operator, or an attacker who first obtained admin credentials — using the leftover debug hook to run system commands and cement control. It's a real code-execution and persistence concern on embedded hardware, but it's not the unauthenticated, internet-sprayed profile that drives botnet-scale campaigns.

So we place this below the unauthenticated router RCEs in the batch while still flagging it, because leftover debug code is durable and persistence-friendly. Our focus is limiting who can reach the management interface at all, since the high-privilege gate means access control is the effective mitigation. Where the interface is tightly restricted, exposure is small; where it's broadly reachable, the gate erodes and the priority rises.