Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
30 vulnerabilities by sitecom
VAR-200605-0266
Vulnerability from variot - Updated: 2024-02-14 23:09Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic. For example, use AddPortMapping to forward arbitrary traffic. Wl-153 is prone to a security bypass vulnerability.
TITLE: Sitecom WL-153 UPnP Shell Command Injection Vulnerability
SECUNIA ADVISORY ID: SA20183
VERIFY ADVISORY: http://secunia.com/advisories/20183/
CRITICAL: Moderately critical
IMPACT: DoS, System access
WHERE:
From local network
OPERATING SYSTEM: Sitecom WL-153 MIMO XR Wireless Network Broadband Router http://secunia.com/product/10081/
DESCRIPTION: Armijn Hemel has reported a vulnerability in Sitecom WL-153, which can be exploited by malicious people to cause a DoS (Denial of Service) and potentially compromise a vulnerable device.
The vulnerability is related to: SA20169
The vulnerability has been reported in firmware versions prior to 1.38.
SOLUTION: Disable the UPnP functionality if it is not required.
The vendor reportedly will release an updated firmware soon.
PROVIDED AND/OR DISCOVERED BY: Armijn Hemel
OTHER REFERENCES: SA20169: http://secunia.com/advisories/20169/
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200605-0266",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wl-153 router",
"scope": "eq",
"trust": 1.9,
"vendor": "sitecom",
"version": "1.31"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 1.3,
"vendor": "sitecom",
"version": null
},
{
"model": "wl-153 router",
"scope": "lte",
"trust": 1.0,
"vendor": "sitecom",
"version": "1.34"
},
{
"model": "wl-153 router",
"scope": "eq",
"trust": 0.9,
"vendor": "sitecom",
"version": "1.34"
},
{
"model": "sitecom 1.38",
"scope": null,
"trust": 0.6,
"vendor": "wl 153",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3387"
},
{
"db": "BID",
"id": "87609"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-429"
},
{
"db": "NVD",
"id": "CVE-2006-2560"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.34",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:1.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sitecom:wl-153:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-2560"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "87609"
}
],
"trust": 0.3
},
"cve": "CVE-2006-2560",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2006-3387",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-18668",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2006-2560",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2006-3387",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200605-429",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-18668",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3387"
},
{
"db": "VULHUB",
"id": "VHN-18668"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-429"
},
{
"db": "NVD",
"id": "CVE-2006-2560"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic. For example, use AddPortMapping to forward arbitrary traffic. Wl-153 is prone to a security bypass vulnerability. \n\nTITLE:\nSitecom WL-153 UPnP Shell Command Injection Vulnerability\n\nSECUNIA ADVISORY ID:\nSA20183\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/20183/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nDoS, System access\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nSitecom WL-153 MIMO XR Wireless Network Broadband Router\nhttp://secunia.com/product/10081/\n\nDESCRIPTION:\nArmijn Hemel has reported a vulnerability in Sitecom WL-153, which\ncan be exploited by malicious people to cause a DoS (Denial of\nService) and potentially compromise a vulnerable device. \n\nThe vulnerability is related to:\nSA20169\n\nThe vulnerability has been reported in firmware versions prior to\n1.38. \n\nSOLUTION:\nDisable the UPnP functionality if it is not required. \n\nThe vendor reportedly will release an updated firmware soon. \n\nPROVIDED AND/OR DISCOVERED BY:\nArmijn Hemel\n\nOTHER REFERENCES:\nSA20169:\nhttp://secunia.com/advisories/20169/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-2560"
},
{
"db": "CNVD",
"id": "CNVD-2006-3387"
},
{
"db": "BID",
"id": "87609"
},
{
"db": "VULHUB",
"id": "VHN-18668"
},
{
"db": "PACKETSTORM",
"id": "46562"
}
],
"trust": 1.89
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2006-2560",
"trust": 2.6
},
{
"db": "SECUNIA",
"id": "20183",
"trust": 2.4
},
{
"db": "VUPEN",
"id": "ADV-2006-1912",
"trust": 1.7
},
{
"db": "CNVD",
"id": "CNVD-2006-3387",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200605-429",
"trust": 0.6
},
{
"db": "BID",
"id": "87609",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-18668",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "46562",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3387"
},
{
"db": "VULHUB",
"id": "VHN-18668"
},
{
"db": "BID",
"id": "87609"
},
{
"db": "PACKETSTORM",
"id": "46562"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-429"
},
{
"db": "NVD",
"id": "CVE-2006-2560"
}
]
},
"id": "VAR-200605-0266",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3387"
},
{
"db": "VULHUB",
"id": "VHN-18668"
}
],
"trust": 1.3256613833333333
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3387"
}
]
},
"last_update_date": "2024-02-14T23:09:27.582000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-264",
"trust": 1.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-18668"
},
{
"db": "NVD",
"id": "CVE-2006-2560"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://secunia.com/advisories/20183"
},
{
"trust": 2.0,
"url": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html"
},
{
"trust": 2.0,
"url": "http://www.securityview.org/how-does-the-upnp-flaw-works.html"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2006/1912"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/1912"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/10081/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/20169/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/20183/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3387"
},
{
"db": "VULHUB",
"id": "VHN-18668"
},
{
"db": "BID",
"id": "87609"
},
{
"db": "PACKETSTORM",
"id": "46562"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-429"
},
{
"db": "NVD",
"id": "CVE-2006-2560"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2006-3387"
},
{
"db": "VULHUB",
"id": "VHN-18668"
},
{
"db": "BID",
"id": "87609"
},
{
"db": "PACKETSTORM",
"id": "46562"
},
{
"db": "CNNVD",
"id": "CNNVD-200605-429"
},
{
"db": "NVD",
"id": "CVE-2006-2560"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-05-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-3387"
},
{
"date": "2006-05-24T00:00:00",
"db": "VULHUB",
"id": "VHN-18668"
},
{
"date": "2006-05-23T00:00:00",
"db": "BID",
"id": "87609"
},
{
"date": "2006-05-23T05:09:34",
"db": "PACKETSTORM",
"id": "46562"
},
{
"date": "2006-05-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200605-429"
},
{
"date": "2006-05-24T01:02:00",
"db": "NVD",
"id": "CVE-2006-2560"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-05-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-3387"
},
{
"date": "2013-01-24T00:00:00",
"db": "VULHUB",
"id": "VHN-18668"
},
{
"date": "2006-05-23T00:00:00",
"db": "BID",
"id": "87609"
},
{
"date": "2006-05-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200605-429"
},
{
"date": "2024-02-14T01:17:43.863000",
"db": "NVD",
"id": "CVE-2006-2560"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200605-429"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sitecom WL-153 Router Firmware UPnP Request Access Control Bypass Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-3387"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200605-429"
}
],
"trust": 0.6
}
}
VAR-201301-0216
Vulnerability from variot - Updated: 2023-12-18 13:34Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921. Sitecom WLM-2501 Contains a cross-site request forgery vulnerability. The Sitecom WLM-2501 is a router device. Sitecom WLM-2501 has multiple CSRF vulnerabilities. Attackers build malicious URIs, entice users to resolve, perform administrator actions in the target user context, and change router parameters
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201301-0216",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wlm-2501",
"scope": "eq",
"trust": 1.6,
"vendor": "sitecom",
"version": null
},
{
"model": "wlm-2501",
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": "wlm-2501",
"scope": "eq",
"trust": 0.6,
"vendor": "sitecom",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-00535"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001239"
},
{
"db": "NVD",
"id": "CVE-2012-1922"
},
{
"db": "CNNVD",
"id": "CNNVD-201301-477"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sitecom:wlm-2501:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1922"
}
]
},
"cve": "CVE-2012-1922",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2012-1922",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2012-1922",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201301-477",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-001239"
},
{
"db": "NVD",
"id": "CVE-2012-1922"
},
{
"db": "CNNVD",
"id": "CNNVD-201301-477"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921. Sitecom WLM-2501 Contains a cross-site request forgery vulnerability. The Sitecom WLM-2501 is a router device. Sitecom WLM-2501 has multiple CSRF vulnerabilities. Attackers build malicious URIs, entice users to resolve, perform administrator actions in the target user context, and change router parameters",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1922"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001239"
},
{
"db": "CNVD",
"id": "CNVD-2013-00535"
}
],
"trust": 2.16
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-1922",
"trust": 3.0
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001239",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2013-00535",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201301-477",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-00535"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001239"
},
{
"db": "NVD",
"id": "CVE-2012-1922"
},
{
"db": "CNNVD",
"id": "CNNVD-201301-477"
}
]
},
"id": "VAR-201301-0216",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-00535"
}
],
"trust": 1.0444444499999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-00535"
}
]
},
"last_update_date": "2023-12-18T13:34:46.927000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Wireless Modem Router 300N WLM-2501",
"trust": 0.8,
"url": "http://www.sitecom.com/wireless-modem-router-300n/p/859"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-001239"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-001239"
},
{
"db": "NVD",
"id": "CVE-2012-1922"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities"
},
{
"trust": 1.6,
"url": "http://www.webapp-security.com/wp-content/uploads/2012/03/sitecom-wlm-2501-new-multiple-csrf-vulnerabilities-1.txt"
},
{
"trust": 1.4,
"url": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities/"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1922"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1922"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-00535"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001239"
},
{
"db": "NVD",
"id": "CVE-2012-1922"
},
{
"db": "CNNVD",
"id": "CNNVD-201301-477"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-00535"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-001239"
},
{
"db": "NVD",
"id": "CVE-2012-1922"
},
{
"db": "CNNVD",
"id": "CNNVD-201301-477"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-01-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-00535"
},
{
"date": "2013-01-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-001239"
},
{
"date": "2013-01-24T01:55:02.223000",
"db": "NVD",
"id": "CVE-2012-1922"
},
{
"date": "2013-01-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201301-477"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-05-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-00535"
},
{
"date": "2013-01-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-001239"
},
{
"date": "2013-01-29T05:00:00",
"db": "NVD",
"id": "CVE-2012-1922"
},
{
"date": "2013-01-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201301-477"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201301-477"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sitecom WLM-2501 Vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-001239"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201301-477"
}
],
"trust": 0.6
}
}
VAR-201208-0530
Vulnerability from variot - Updated: 2023-12-18 13:09Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201208-0530",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wlm-2501",
"scope": "eq",
"trust": 1.6,
"vendor": "sitecom",
"version": null
},
{
"model": "wlm-2501",
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003904"
},
{
"db": "NVD",
"id": "CVE-2012-1921"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-562"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sitecom:wlm-2501:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1921"
}
]
},
"cve": "CVE-2012-1921",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 9.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2012-1921",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2012-1921",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2012-1921",
"trust": 0.8,
"value": "High"
},
{
"author": "CNNVD",
"id": "CNNVD-201208-562",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003904"
},
{
"db": "NVD",
"id": "CVE-2012-1921"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-562"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter",
"sources": [
{
"db": "NVD",
"id": "CVE-2012-1921"
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003904"
}
],
"trust": 1.62
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2012-1921",
"trust": 2.4
},
{
"db": "PACKETSTORM",
"id": "110770",
"trust": 1.6
},
{
"db": "JVNDB",
"id": "JVNDB-2012-003904",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201208-562",
"trust": 0.6
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003904"
},
{
"db": "NVD",
"id": "CVE-2012-1921"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-562"
}
]
},
"id": "VAR-201208-0530",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VARIoT devices database",
"id": null
}
],
"trust": 0.44444445
},
"last_update_date": "2023-12-18T13:09:38.956000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.sitecom.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003904"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003904"
},
{
"db": "NVD",
"id": "CVE-2012-1921"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.6,
"url": "http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html"
},
{
"trust": 1.6,
"url": "http://packetstormsecurity.org/files/110770/sitecom-wlm-2501-cross-site-request-forgery.html"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2012-1921"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2012-1921"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003904"
},
{
"db": "NVD",
"id": "CVE-2012-1921"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-562"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003904"
},
{
"db": "NVD",
"id": "CVE-2012-1921"
},
{
"db": "CNNVD",
"id": "CNNVD-201208-562"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-08-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-003904"
},
{
"date": "2012-08-26T20:55:01.090000",
"db": "NVD",
"id": "CVE-2012-1921"
},
{
"date": "2012-08-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201208-562"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-08-29T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2012-003904"
},
{
"date": "2013-01-24T05:00:00",
"db": "NVD",
"id": "CVE-2012-1921"
},
{
"date": "2012-08-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201208-562"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201208-562"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sitecom WLM-2501 Vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2012-003904"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201208-562"
}
],
"trust": 0.6
}
}
VAR-201401-0271
Vulnerability from variot - Updated: 2023-12-18 12:21Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a "URL redirection" issue that some sources list separately. Allegro RomPager is prone to a URI-redirection vulnerability and a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. Attackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible. Allegro RomPager 4.07 is vulnerable; other versions may also be affected. Allegro Software Development RomPager is an embedded Web server toolkit from Allegro Software Development in the United States, which allows users to use a common Web browser to manage and control the World Wide Web (WWW) services of network devices such as network printers, switches and routers. The following products and models are affected: ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, D-Link DSL-2640R and DSL-2641R
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201401-0271",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "p-660hw d1",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": null
},
{
"model": "dsl-2640r",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "mt882",
"scope": "eq",
"trust": 1.0,
"vendor": "huawei",
"version": null
},
{
"model": "rompager",
"scope": "lte",
"trust": 1.0,
"vendor": "allegrosoft",
"version": "4.07"
},
{
"model": "dsl-2641r",
"scope": "eq",
"trust": 1.0,
"vendor": "dlink",
"version": null
},
{
"model": "td-8816",
"scope": "eq",
"trust": 1.0,
"vendor": "tp link",
"version": null
},
{
"model": "wl-174",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": null
},
{
"model": "rompager",
"scope": "lt",
"trust": 0.8,
"vendor": "allegro",
"version": "4.51"
},
{
"model": "dsl-2640r",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "dsl-2641r",
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": "smartax mt882",
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": "wl-174",
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": "td-8816",
"scope": null,
"trust": 0.8,
"vendor": "tp link",
"version": null
},
{
"model": "p-660hw-d1",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "dsl-2641r",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "dsl-2640r",
"scope": "eq",
"trust": 0.6,
"vendor": "d link",
"version": null
},
{
"model": "p660hw-d1",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "td-8816",
"scope": "eq",
"trust": 0.3,
"vendor": "tp link",
"version": "0"
},
{
"model": "wl-174",
"scope": "eq",
"trust": 0.3,
"vendor": "sitecom",
"version": "0"
},
{
"model": "mt882",
"scope": "eq",
"trust": 0.3,
"vendor": "huawei",
"version": "0"
},
{
"model": "dsl-2641r",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "0"
},
{
"model": "dsl-2640r",
"scope": "eq",
"trust": 0.3,
"vendor": "d link",
"version": "0"
},
{
"model": "rompager",
"scope": "eq",
"trust": 0.3,
"vendor": "allegro",
"version": "4.07"
},
{
"model": "rompager",
"scope": "ne",
"trust": 0.3,
"vendor": "allegro",
"version": "4.51"
}
],
"sources": [
{
"db": "BID",
"id": "63721"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"db": "NVD",
"id": "CVE-2013-6786"
},
{
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:zyxel:p-660hw_d1:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:sitecom:wl-174:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:allegrosoft:rompager:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.07",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:tp-link:td-8816:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:huawei:mt882:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:dlink:dsl-2640r:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:dlink:dsl-2641r:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2013-6786"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Antonio Vzquez Blanco",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
],
"trust": 0.6
},
"cve": "CVE-2013-6786",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2013-6786",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.9,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-66788",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2013-6786",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201311-215",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-66788",
"trust": 0.1,
"value": "MEDIUM"
},
{
"author": "VULMON",
"id": "CVE-2013-6786",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-66788"
},
{
"db": "VULMON",
"id": "CVE-2013-6786"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"db": "NVD",
"id": "CVE-2013-6786"
},
{
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the \"forbidden author header\" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a \"URL redirection\" issue that some sources list separately. Allegro RomPager is prone to a URI-redirection vulnerability and a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input. \nAttackers can exploit these issues to execute arbitrary script or HTML code, steal cookie-based authentication credentials, and conduct phishing attacks. Other attacks may also be possible. \nAllegro RomPager 4.07 is vulnerable; other versions may also be affected. Allegro Software Development RomPager is an embedded Web server toolkit from Allegro Software Development in the United States, which allows users to use a common Web browser to manage and control the World Wide Web (WWW) services of network devices such as network printers, switches and routers. The following products and models are affected: ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, D-Link DSL-2640R and DSL-2641R",
"sources": [
{
"db": "NVD",
"id": "CVE-2013-6786"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"db": "BID",
"id": "63721"
},
{
"db": "VULHUB",
"id": "VHN-66788"
},
{
"db": "VULMON",
"id": "CVE-2013-6786"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2013-6786",
"trust": 2.9
},
{
"db": "OSVDB",
"id": "99694",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005853",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201311-215",
"trust": 0.7
},
{
"db": "BID",
"id": "63721",
"trust": 0.5
},
{
"db": "VULHUB",
"id": "VHN-66788",
"trust": 0.1
},
{
"db": "VULMON",
"id": "CVE-2013-6786",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-66788"
},
{
"db": "VULMON",
"id": "CVE-2013-6786"
},
{
"db": "BID",
"id": "63721"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"db": "NVD",
"id": "CVE-2013-6786"
},
{
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
]
},
"id": "VAR-201401-0271",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-66788"
}
],
"trust": 0.6416666999999999
},
"last_update_date": "2023-12-18T12:21:31.372000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "RomPager Embedded Web Server Toolkits",
"trust": 0.8,
"url": "http://www.allegrosoft.com/embedded-web-server"
},
{
"title": "Allegro RomPager HTTP Referer Header URI Fixes for cross-site scripting vulnerabilities",
"trust": 0.6,
"url": "http://123.124.177.30/web/xxk/bdxqbyid.tag?id=234984"
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/r3p3r/cve-search "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/extremenetworks/cve-search-src "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/dim0niu/cve-search "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/cve-search/cve-search "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/pgurudatta/cve-search "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/kawtar01/cve-search "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/miradam/cve-search "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/zwei2008/cve "
},
{
"title": "Instruction and Implementation\ncve-search",
"trust": 0.1,
"url": "https://github.com/swastik99/cve-search-master "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/cve-search/cve-search-ng "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/jerfinj/cve-search "
},
{
"title": "Instruction and Implementation\ncve-search",
"trust": 0.1,
"url": "https://github.com/swastik99/cve-search "
},
{
"title": "cve-search",
"trust": 0.1,
"url": "https://github.com/hr-cert/modified_cve-search "
}
],
"sources": [
{
"db": "VULMON",
"id": "CVE-2013-6786"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-66788"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"db": "NVD",
"id": "CVE-2013-6786"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.6,
"url": "http://osvdb.org/ref/99/rompager407.pdf"
},
{
"trust": 2.1,
"url": "http://antoniovazquezblanco.github.io/docs/advisories/advisory_rompagerxss.pdf"
},
{
"trust": 1.8,
"url": "http://osvdb.org/99694"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-6786"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-6786"
},
{
"trust": 0.3,
"url": "http://www.allegrosoft.com/embedded-web-server"
},
{
"trust": 0.1,
"url": "https://cwe.mitre.org/data/definitions/79.html"
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov"
},
{
"trust": 0.1,
"url": "https://www.securityfocus.com/bid/63721"
},
{
"trust": 0.1,
"url": "https://github.com/r3p3r/cve-search"
},
{
"trust": 0.1,
"url": "https://github.com/dim0niu/cve-search"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-66788"
},
{
"db": "VULMON",
"id": "CVE-2013-6786"
},
{
"db": "BID",
"id": "63721"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"db": "NVD",
"id": "CVE-2013-6786"
},
{
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-66788"
},
{
"db": "VULMON",
"id": "CVE-2013-6786"
},
{
"db": "BID",
"id": "63721"
},
{
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"db": "NVD",
"id": "CVE-2013-6786"
},
{
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-16T00:00:00",
"db": "VULHUB",
"id": "VHN-66788"
},
{
"date": "2014-01-16T00:00:00",
"db": "VULMON",
"id": "CVE-2013-6786"
},
{
"date": "2013-11-12T00:00:00",
"db": "BID",
"id": "63721"
},
{
"date": "2014-01-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"date": "2014-01-16T19:55:04.607000",
"db": "NVD",
"id": "CVE-2013-6786"
},
{
"date": "2013-11-12T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-01-17T00:00:00",
"db": "VULHUB",
"id": "VHN-66788"
},
{
"date": "2023-04-26T00:00:00",
"db": "VULMON",
"id": "CVE-2013-6786"
},
{
"date": "2013-11-12T00:00:00",
"db": "BID",
"id": "63721"
},
{
"date": "2014-01-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2013-005853"
},
{
"date": "2023-04-26T18:55:30.893000",
"db": "NVD",
"id": "CVE-2013-6786"
},
{
"date": "2023-04-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Used in multiple products Allegro RomPager Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2013-005853"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201311-215"
}
],
"trust": 0.6
}
}
VAR-201111-0179
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen on the WAN port, which allows remote attackers to administer the firewall via SOAP requests. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0179",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linksys wrt54gx router",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.00.05"
},
{
"model": "wrt54gx",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "2.0"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "linksys wrt54gx router",
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": "wrt54gx",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "firmware 2.00.05"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54gx_router_firmware:2.00.05:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gx:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4500"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4500",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4500",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52445",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4500",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-362",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52445",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen on the WAN port, which allows remote attackers to administer the firewall via SOAP requests. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4500",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5055",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52445",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"id": "VAR-201111-0179",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "VULHUB",
"id": "VHN-52445"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5055"
}
]
},
"last_update_date": "2023-12-18T12:09:30.385000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.cisco.com/"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5055)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6024"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.8,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4500"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4500"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52445"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:04.793000",
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52445"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-22T11:55:04.793000",
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"date": "2011-11-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
],
"trust": 0.6
}
}
VAR-201111-0160
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in the Pseudo ICS UPnP software on the ZyXEL P-330W allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. ZyXEL P-330W is a wireless broadband router. A vulnerability exists in the UPnP IGD installation enablement of the ZyXEL P-330W's Pseudo ICS UPnP software. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0160",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pseudoics",
"scope": "eq",
"trust": 1.6,
"vendor": "genmei mori",
"version": "0.1"
},
{
"model": "pseudoics",
"scope": "eq",
"trust": 1.6,
"vendor": "genmei mori",
"version": "0.3"
},
{
"model": "pseudoics",
"scope": "eq",
"trust": 1.6,
"vendor": "genmei mori",
"version": "0.2"
},
{
"model": "p-330w router",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "*"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "pseudo ics upnp",
"scope": null,
"trust": 0.8,
"vendor": "genmei mori",
"version": null
},
{
"model": "p-330w",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:genmei_mori:pseudoics:0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:genmei_mori:pseudoics:0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:genmei_mori:pseudoics:0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:zyxel:p-330w_router:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4504"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4504",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4504",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52449",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4504",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-366",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52449",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in the Pseudo ICS UPnP software on the ZyXEL P-330W allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. ZyXEL P-330W is a wireless broadband router. A vulnerability exists in the UPnP IGD installation enablement of the ZyXEL P-330W\u0027s Pseudo ICS UPnP software. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4504",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5060",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52449",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"id": "VAR-201111-0160",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "VULHUB",
"id": "VHN-52449"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5060"
}
]
},
"last_update_date": "2023-12-18T12:09:30.333000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.zyxel.com/"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5060)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6020"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 1.7,
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.1,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4504"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu357851/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4504"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52449"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:06.013000",
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"date": "2012-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-52449"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2012-03-08T05:00:00",
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
],
"trust": 0.6
}
}
VAR-201111-0162
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation on the Thomson (aka Technicolor) TG585 with firmware 7.x before 7.4.3.2 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. A vulnerability exists in the UPnP IGD installation enablement in Thomson (also known as Technicolor) TG585 with firmware 7.x prior to firmware 7.4.3.2. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0162",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tg585 router",
"scope": "lte",
"trust": 1.0,
"vendor": "technicolor",
"version": "7.4"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 1.0,
"vendor": "technicolor",
"version": "*"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "tg585",
"scope": "lt",
"trust": 0.8,
"vendor": "technicolor",
"version": "7.x"
},
{
"model": "tg585",
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": "tg585",
"scope": "eq",
"trust": 0.8,
"vendor": "technicolor",
"version": "7.4.3.2"
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.6,
"vendor": "technicolor",
"version": "7.4"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:technicolor:tg585_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.4",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:technicolor:tg585_router:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4506"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4506",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4506",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52451",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4506",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-368",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52451",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation on the Thomson (aka Technicolor) TG585 with firmware 7.x before 7.4.3.2 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. A vulnerability exists in the UPnP IGD installation enablement in Thomson (also known as Technicolor) TG585 with firmware 7.x prior to firmware 7.4.3.2. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4506",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5064",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52451",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"id": "VAR-201111-0162",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "VULHUB",
"id": "VHN-52451"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5064"
}
]
},
"last_update_date": "2023-12-18T12:09:30.242000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.technicolorbroadbandpartner.com/index.php"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5064)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6022"
},
{
"title": "thomson-download",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=41851"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.5,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 1.1,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4506"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4506"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52451"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:06.137000",
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"date": "2012-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-52451"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"date": "2012-03-08T05:00:00",
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
],
"trust": 0.6
}
}
VAR-201111-0178
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. A vulnerability exists in the UPnP IGD installation and enablement of multiple versions of the Broadcom UPnP stack on the Cisco Linksys WRT54G. This vulnerability is related to the "external forwarding" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0178",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linksys wrt54gs router",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.09.1"
},
{
"model": "linksys wrt54g router",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "3.03.9"
},
{
"model": "linksys wrt54g router",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.20.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "2.2"
},
{
"model": "wrt54gs",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "1.0"
},
{
"model": "wrt54gs",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "3.0"
},
{
"model": "linksys wrt54gs router",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "1.06"
},
{
"model": "wrt54gs",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "4.0"
},
{
"model": "wrt54gs",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "2.0"
},
{
"model": "linksys wrt54gs router",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "4.70.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "*"
},
{
"model": "linksys wrt54g router",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "4.20.8"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "linksys wrt54g router",
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": "linksys wrt54gs router",
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": "wrt54g",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "firmware 4.30.5"
},
{
"model": "wrt54gs",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "v1 from v3 firmware 4.71.1"
},
{
"model": "wrt54gs",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "v4 firmware 1.06.1"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "linksys wrt54gs router",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "4.70.6"
},
{
"model": "linksys wrt54g router",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "4.20.8"
},
{
"model": "linksys wrt54gs router",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "1.06"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54g_router_firmware:3.03.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54g_router_firmware:4.20.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54g_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.20.8",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54g:2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54g:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54gs_router_firmware:2.09.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54gs_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.70.6",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gs:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gs:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gs:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54gs_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.06",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gs:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4499"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4499",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4499",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52444",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4499",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-361",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52444",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. A vulnerability exists in the UPnP IGD installation and enablement of multiple versions of the Broadcom UPnP stack on the Cisco Linksys WRT54G. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4499",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-5053",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52444",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"id": "VAR-201111-0178",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "VULHUB",
"id": "VHN-52444"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5053"
}
]
},
"last_update_date": "2023-12-18T12:09:30.055000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.cisco.com/"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5053)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6023"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.8,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4499"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4499"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52444"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:04.683000",
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"date": "2012-03-09T00:00:00",
"db": "VULHUB",
"id": "VHN-52444"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2012-03-09T05:00:00",
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
],
"trust": 0.6
}
}
VAR-201111-0180
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. Vulnerabilities exist in the UPnP IGD installation and enablement of Edimax EdiLinux for various versions of Edimax. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0180",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lb000021 router",
"scope": "eq",
"trust": 2.4,
"vendor": "sweex",
"version": "3.15"
},
{
"model": "6114wg router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "2.08"
},
{
"model": "br-6104k router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "3.21"
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": null
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": null
},
{
"model": "wl-153 router",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": "1.31"
},
{
"model": "wl-153 router",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": "1.34"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": null
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": null
},
{
"model": "6114wg",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": null
},
{
"model": "lb000021",
"scope": "eq",
"trust": 1.0,
"vendor": "sweex",
"version": null
},
{
"model": "cn-wf514 router",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "6114wg router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "1.83"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "cn-wf512",
"scope": null,
"trust": 0.8,
"vendor": "canyon",
"version": null
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 0.8,
"vendor": "canyon",
"version": "1.83"
},
{
"model": "cn-wf514",
"scope": null,
"trust": 0.8,
"vendor": "canyon",
"version": null
},
{
"model": "cn-wf514 router",
"scope": "eq",
"trust": 0.8,
"vendor": "canyon",
"version": "2.08"
},
{
"model": "br-6104k",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "br-6104k router",
"scope": "lt",
"trust": 0.8,
"vendor": "edimax",
"version": "3.25"
},
{
"model": "br-6114wg",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "br-6114wg router",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "wl-153",
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": "wl-153 router",
"scope": "lt",
"trust": 0.8,
"vendor": "sitecom",
"version": "1.39"
},
{
"model": "lb000021",
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:edimax:br-6104k_router_firmware:3.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:edimax:br-6104k:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canyon-tech:cn-wf512_router_firmware:1.83:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canyon-tech:cn-wf514_router_firmware:2.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:canyon-tech:cn-wf514:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:canyon-tech:cn-wf512:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:edimax:6114wg_router_firmware:1.83:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:edimax:6114wg_router_firmware:2.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:edimax:6114wg:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:1.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:1.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sitecom:wl-153:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sweex:lb000021_router_firmware:3.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sweex:lb000021:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4501"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4501",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4501",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-52446",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4501",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-363",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-52446",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. Vulnerabilities exist in the UPnP IGD installation and enablement of Edimax EdiLinux for various versions of Edimax. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4501",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5058",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52446",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"id": "VAR-201111-0180",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "VULHUB",
"id": "VHN-52446"
}
],
"trust": 1.3453724428571427
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5058"
}
]
},
"last_update_date": "2023-12-18T12:09:29.878000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.canyon-tech.com/"
},
{
"title": "BR-6104K",
"trust": 0.8,
"url": "http://www.edimax.com/en/produce_detail.php?pd_id=58\u0026pl1_id=3\u0026pl2_id=18"
},
{
"title": "BR-6114Wg",
"trust": 0.8,
"url": "http://www.edimax.co.uk/en/produce_detail.php?pd_id=146\u0026pl1_id=1\u0026pl2_id=48"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.sitecom.com/"
},
{
"title": "LB000021",
"trust": 0.8,
"url": "http://www.sweex.com/en/assortiment/internet-networking/routers/lb000021/"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5058)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6019"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.8,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 1.7,
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4501"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4501"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52446"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:04.887000",
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"date": "2013-01-24T00:00:00",
"db": "VULHUB",
"id": "VHN-52446"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"date": "2013-01-24T05:00:00",
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
],
"trust": 0.6
}
}
VAR-201111-0161
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation on SpeedTouch 5x6 devices with firmware before 6.2.29 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. Speedtouch is a wireless Internet router for the home. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0161",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedtouch 5x6 router",
"scope": "lte",
"trust": 1.0,
"vendor": "alcatel",
"version": "6.2"
},
{
"model": "speedtouch 5x6 router",
"scope": "eq",
"trust": 1.0,
"vendor": "alcatel",
"version": "*"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "speedtouch 5x6 router",
"scope": null,
"trust": 0.8,
"vendor": "alcatel lucent",
"version": null
},
{
"model": "speedtouch 5x6 router",
"scope": "lt",
"trust": 0.8,
"vendor": "alcatel lucent",
"version": "6.2.29"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "speedtouch 5x6 router",
"scope": "eq",
"trust": 0.6,
"vendor": "alcatel",
"version": "6.2"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:alcatel:speedtouch_5x6_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.2",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:alcatel:speedtouch_5x6_router:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4505"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4505",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4505",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52450",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4505",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-367",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52450",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation on SpeedTouch 5x6 devices with firmware before 6.2.29 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. Speedtouch is a wireless Internet router for the home. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4505",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5063",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52450",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"id": "VAR-201111-0161",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "VULHUB",
"id": "VHN-52450"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5063"
}
]
},
"last_update_date": "2023-12-18T12:09:29.730000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.alcatel-lucent.com"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5063)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6021"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.5,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 1.1,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4505"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4505"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52450"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:06.090000",
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"date": "2012-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-52450"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2012-03-08T05:00:00",
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
],
"trust": 0.6
}
}
VAR-201111-0159
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. A vulnerability exists in the UPnP IGD installation of Broadcom Linux for Sitecom WL-111. This vulnerability is related to the \"external forwarding\" vulnerability. An attacker can exploit this issue to gain unauthorized access to scan the internal host or proxy internet traffic through an affected device. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0159",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linux",
"scope": null,
"trust": 2.0,
"vendor": "broadcom",
"version": null
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "*"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wl-111",
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.3,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.3,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.3,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.3,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.3,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.3,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:broadcom:broadcom_linux:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sitecom:wl-111:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4503"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4503",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4503",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4503",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-365",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. A vulnerability exists in the UPnP IGD installation of Broadcom Linux for Sitecom WL-111. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. \nAn attacker can exploit this issue to gain unauthorized access to scan the internal host or proxy internet traffic through an affected device. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.77
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.7
},
{
"db": "NVD",
"id": "CVE-2011-4503",
"trust": 3.3
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-5043",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"id": "VAR-201111-0159",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5043"
}
],
"trust": 1.361728088888889
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5043"
}
]
},
"last_update_date": "2023-12-18T12:09:29.415000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.broadcom.com/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.sitecom.com/"
},
{
"title": "Patch for Sitecom WL-111 configuration vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6004"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.9,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 1.6,
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"trust": 1.1,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4503"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4503"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:05.967000",
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"date": "2013-01-24T05:00:00",
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
],
"trust": 0.6
}
}
VAR-201111-0158
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. There are vulnerabilities in the Edimax Edimax EdiLinux UPnP IGD installation enablement. An attacker can exploit this issue to gain unauthorized access to scan the internal host or proxy internet traffic through an affected device. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0158",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lb000021 router",
"scope": "eq",
"trust": 3.0,
"vendor": "sweex",
"version": "3.15"
},
{
"model": "br-6104k",
"scope": null,
"trust": 1.4,
"vendor": "edimax",
"version": null
},
{
"model": "wl-153",
"scope": null,
"trust": 1.4,
"vendor": "sitecom",
"version": null
},
{
"model": "6114wg router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "2.08"
},
{
"model": "br-6104k router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "3.21"
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": null
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": null
},
{
"model": "wl-153 router",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": "1.31"
},
{
"model": "wl-153 router",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": "1.34"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": null
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": null
},
{
"model": "6114wg",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": null
},
{
"model": "lb000021",
"scope": "eq",
"trust": 1.0,
"vendor": "sweex",
"version": null
},
{
"model": "cn-wf514 router",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "6114wg router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "1.83"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "cn-wf512",
"scope": null,
"trust": 0.8,
"vendor": "canyon",
"version": null
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 0.8,
"vendor": "canyon",
"version": "1.83"
},
{
"model": "cn-wf514",
"scope": null,
"trust": 0.8,
"vendor": "canyon",
"version": null
},
{
"model": "cn-wf514 router",
"scope": "eq",
"trust": 0.8,
"vendor": "canyon",
"version": "2.08"
},
{
"model": "br-6104k router",
"scope": "lt",
"trust": 0.8,
"vendor": "edimax",
"version": "3.25"
},
{
"model": "br-6114wg",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "br-6114wg router",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "wl-153 router",
"scope": "lt",
"trust": 0.8,
"vendor": "sitecom",
"version": "1.39"
},
{
"model": "lb000021",
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": "br-6104k router",
"scope": "eq",
"trust": 0.6,
"vendor": "edimax",
"version": "3.21/2.08/1.83"
},
{
"model": "6114wg",
"scope": null,
"trust": 0.6,
"vendor": "edimax",
"version": null
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 0.6,
"vendor": "canyon tech",
"version": "2.08/1.83"
},
{
"model": "cn-wf514",
"scope": null,
"trust": 0.6,
"vendor": "canyon tech",
"version": null
},
{
"model": "cn-wf512",
"scope": null,
"trust": 0.6,
"vendor": "canyon tech",
"version": null
},
{
"model": "wl-153 router /1.34 router",
"scope": "eq",
"trust": 0.6,
"vendor": "sitecom",
"version": "1.31"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.3,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.3,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.3,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.3,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.3,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.3,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:edimax:br-6104k_router_firmware:3.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:edimax:br-6104k:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canyon-tech:cn-wf512_router_firmware:1.83:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canyon-tech:cn-wf514_router_firmware:2.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:canyon-tech:cn-wf514:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:canyon-tech:cn-wf512:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:edimax:6114wg_router_firmware:1.83:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:edimax:6114wg_router_firmware:2.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:edimax:6114wg:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:1.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:1.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sitecom:wl-153:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sweex:lb000021_router_firmware:3.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sweex:lb000021:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4502"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4502",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4502",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-52447",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4502",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-364",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-52447",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. There are vulnerabilities in the Edimax Edimax EdiLinux UPnP IGD installation enablement. \nAn attacker can exploit this issue to gain unauthorized access to scan the internal host or proxy internet traffic through an affected device. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4502",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5045",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52447",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"id": "VAR-201111-0158",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "VULHUB",
"id": "VHN-52447"
}
],
"trust": 1.3453724428571427
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5045"
}
]
},
"last_update_date": "2023-12-18T12:09:29.362000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.canyon-tech.com/"
},
{
"title": "BR-6104K",
"trust": 0.8,
"url": "http://www.edimax.com/en/produce_detail.php?pd_id=58\u0026pl1_id=3\u0026pl2_id=18"
},
{
"title": "BR-6114Wg",
"trust": 0.8,
"url": "http://www.edimax.co.uk/en/produce_detail.php?pd_id=146\u0026pl1_id=1\u0026pl2_id=48"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.sitecom.com/"
},
{
"title": "LB000021",
"trust": 0.8,
"url": "http://www.sweex.com/en/assortiment/internet-networking/routers/lb000021/"
},
{
"title": "Patch for Edimax \u0027Edimax EdiLinux\u0027 configuration vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6005"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "CWE-16",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 5.0,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.8,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 1.7,
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4502"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4502"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52447"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:05.043000",
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"date": "2011-11-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"date": "2013-01-24T00:00:00",
"db": "VULHUB",
"id": "VHN-52447"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"date": "2013-01-24T05:00:00",
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"date": "2011-11-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
],
"trust": 0.6
}
}
VAR-201203-0518
Vulnerability from variot - Updated: 2022-05-17 02:04The Sitecom WLM-2501 is a router device. Sitecom WLM-2501 has multiple CSRF vulnerabilities. Attackers build malicious URIs, entice users to resolve, perform administrator actions in the target user context, and change router parameters. Sitecom WLM-2501 is prone to multiple cross-site request-forgery vulnerabilities because the device fails to properly validate HTTP requests. Attackers can exploit these issues to gain unauthorized access to the affected device and perform certain administrative actions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201203-0518",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wlm-2501",
"scope": "eq",
"trust": 0.9,
"vendor": "sitecom",
"version": "0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-1562"
},
{
"db": "BID",
"id": "52700"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Ivano Binetti",
"sources": [
{
"db": "BID",
"id": "52700"
}
],
"trust": 0.3
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Sitecom WLM-2501 is a router device. Sitecom WLM-2501 has multiple CSRF vulnerabilities. Attackers build malicious URIs, entice users to resolve, perform administrator actions in the target user context, and change router parameters. Sitecom WLM-2501 is prone to multiple cross-site request-forgery vulnerabilities because the device fails to properly validate HTTP requests. \nAttackers can exploit these issues to gain unauthorized access to the affected device and perform certain administrative actions",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-1562"
},
{
"db": "BID",
"id": "52700"
}
],
"trust": 0.81
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "52700",
"trust": 0.9
},
{
"db": "CNVD",
"id": "CNVD-2012-1562",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-1562"
},
{
"db": "BID",
"id": "52700"
}
]
},
"id": "VAR-201203-0518",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-1562"
}
],
"trust": 1.0444444499999999
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-1562"
}
]
},
"last_update_date": "2022-05-17T02:04:44.285000Z",
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 0.9,
"url": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities/"
},
{
"trust": 0.3,
"url": "http://www.sitecom.com/wireless-modem-router-300n/p/859"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-1562"
},
{
"db": "BID",
"id": "52700"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2012-1562"
},
{
"db": "BID",
"id": "52700"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-03-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-1562"
},
{
"date": "2012-03-22T00:00:00",
"db": "BID",
"id": "52700"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-03-27T00:00:00",
"db": "CNVD",
"id": "CNVD-2012-1562"
},
{
"date": "2012-03-22T00:00:00",
"db": "BID",
"id": "52700"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "52700"
}
],
"trust": 0.3
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sitecom WLM-2501 Cross-Site Request Forgery Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2012-1562"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "52700"
}
],
"trust": 0.3
}
}
VAR-201304-0504
Vulnerability from variot - Updated: 2022-05-17 02:03Sitecom WLM-3500 has the following backdoor accounts that can be used to bypass security restrictions:
Account 1
username: qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqw
ertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyui
password: 123456789012345678901234567890123456789012345678901234567890123456789012
34567890123456789012345678901234567890123456789012345678
Account 2
username: user3
password: 123456789012345678901234567890123456789012345678901234567890123456789012
34567890123456789012345678901234567890123456789012345678
These accounts can access the "/romfile.cfg" configuration file, obtain the "admin" user password, and control application devices. Sitecom WLM-3500 is a wireless router. There are multiple authentication bypass vulnerabilities in versions prior to Sitecom WLM-3500 1.07 firmware. Attackers can use these vulnerabilities to gain unauthorized access to the device and perform unauthorized operations, which can lead to complete control of the device. Sitecom WLM-3500 is prone to multiple authentication-bypass vulnerabilities
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201304-0504",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wlm-3500 versions",
"scope": "lt",
"trust": 0.6,
"vendor": "sitecom",
"version": "1.07"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-03589"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Roberto Paleari of Emaze Networks S.p.A",
"sources": [
{
"db": "BID",
"id": "59267"
},
{
"db": "CNNVD",
"id": "CNNVD-201304-398"
}
],
"trust": 0.9
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "CNVD-2013-03589",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "CNVD",
"id": "CNVD-2013-03589",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-03589"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "\r\n\r\n\r\nSitecom WLM-3500 has the following backdoor accounts that can be used to bypass security restrictions:\r\n\r\n\r\nAccount 1\r\r\n\r\n ---------\r\r\n\r\nusername: qwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqw\r\r\n\r\nertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyuiopqwertyui\r\r\n\r\npassword: 123456789012345678901234567890123456789012345678901234567890123456789012\r\r\n\r\n34567890123456789012345678901234567890123456789012345678\r\n\r\n\r\nAccount 2\r\r\n\r\n ---------\r\r\n\r\nusername: user3\r\r\n\r\npassword: 123456789012345678901234567890123456789012345678901234567890123456789012\r\r\n\r\n34567890123456789012345678901234567890123456789012345678\r\n\r\n\r\nThese accounts can access the \"/romfile.cfg\" configuration file, obtain the \"admin\" user password, and control application devices. Sitecom WLM-3500 is a wireless router. \nThere are multiple authentication bypass vulnerabilities in versions prior to Sitecom WLM-3500 1.07 firmware. Attackers can use these vulnerabilities to gain unauthorized access to the device and perform unauthorized operations, which can lead to complete control of the device. Sitecom WLM-3500 is prone to multiple authentication-bypass vulnerabilities",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-03589"
},
{
"db": "CNNVD",
"id": "CNNVD-201304-398"
},
{
"db": "BID",
"id": "59267"
}
],
"trust": 1.35
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "59267",
"trust": 1.5
},
{
"db": "CNVD",
"id": "CNVD-2013-03589",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201304-398",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-03589"
},
{
"db": "BID",
"id": "59267"
},
{
"db": "CNNVD",
"id": "CNNVD-201304-398"
}
]
},
"id": "VAR-201304-0504",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-03589"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-03589"
}
]
},
"last_update_date": "2022-05-17T02:03:23.749000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Patch for Sitecom WLM-3500 backdoor account verification bypass vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/33479"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-03589"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/526372/30/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/59267"
},
{
"trust": 0.3,
"url": "http://www.sitecom.com"
},
{
"trust": 0.3,
"url": "http://blog.emaze.net/2013/04/sitecom-wlm-3500-backdoor-accounts.html"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-03589"
},
{
"db": "BID",
"id": "59267"
},
{
"db": "CNNVD",
"id": "CNNVD-201304-398"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-03589"
},
{
"db": "BID",
"id": "59267"
},
{
"db": "CNNVD",
"id": "CNNVD-201304-398"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-04-22T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-03589"
},
{
"date": "2013-04-17T00:00:00",
"db": "BID",
"id": "59267"
},
{
"date": "2013-04-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201304-398"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-03-10T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-03589"
},
{
"date": "2013-04-17T00:00:00",
"db": "BID",
"id": "59267"
},
{
"date": "2013-04-19T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201304-398"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201304-398"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sitecom WLM-3500 Hardcoded User Credentials Multiple Authentication Bypass Vulnerabilities",
"sources": [
{
"db": "BID",
"id": "59267"
},
{
"db": "CNNVD",
"id": "CNNVD-201304-398"
}
],
"trust": 0.9
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "59267"
}
],
"trust": 0.3
}
}
VAR-201308-0494
Vulnerability from variot - Updated: 2022-05-17 02:01The Sitecom WLM-3500 and WLM-5500 devices have vulnerabilities that allow the Telnet service to be opened by accessing the \"http:///cgi-bin/telnetControl.cgi\" URL, which is accessible via the WAN interface and allows remote access. The attacker accesses and controls the device through the telnet service. The Sitecom WLM-3500 and WLM-5500 are wireless router products developed by Sitecom. The Sitecom WLM-3500 and WLM-5500 devices generate WPA2 ciphertext and WEB administrator user passwords based on the MAC address of the wireless interface card. Attackers in the Wi-Fi network range can calculate the default wireless password and access device. Multiple Sitecom products are prone to multiple authentication-bypass vulnerabilities. Attackers can exploit these issues to gain unauthorized access to the device and perform unauthorized actions. This can lead to a complete compromise of the devices. The following products are vulnerable: Sitecom WLM-3500v2001 firmware 1.07 Sitecom WLM-5500v1001 firmware 1.15
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201308-0494",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wlm-3500",
"scope": "eq",
"trust": 1.2,
"vendor": "sitecom",
"version": "v20011.07"
},
{
"model": "wlm-5500",
"scope": "eq",
"trust": 1.2,
"vendor": "sitecom",
"version": "v10011.15"
},
{
"model": "wlm-5501v1001",
"scope": "eq",
"trust": 0.3,
"vendor": "sitecom",
"version": "1.15"
},
{
"model": "wlm-3500v2001",
"scope": "eq",
"trust": 0.3,
"vendor": "sitecom",
"version": "1.07"
},
{
"model": "wlm-5501v1001",
"scope": "ne",
"trust": 0.3,
"vendor": "sitecom",
"version": "2.01"
},
{
"model": "wlm-3500v2001",
"scope": "ne",
"trust": 0.3,
"vendor": "sitecom",
"version": "1.08"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"db": "CNVD",
"id": "CNVD-2013-12606"
},
{
"db": "BID",
"id": "61829"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Roberto Paleari and Alessandro Di Pinto",
"sources": [
{
"db": "BID",
"id": "61829"
}
],
"trust": 0.3
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2013-12607",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"id": "CNVD-2013-12606",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "CNVD",
"id": "CNVD-2013-12607",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2013-12606",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"db": "CNVD",
"id": "CNVD-2013-12606"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Sitecom WLM-3500 and WLM-5500 devices have vulnerabilities that allow the Telnet service to be opened by accessing the \\\"http://\u003ctarget-ip\u003e/cgi-bin/telnetControl.cgi\\\" URL, which is accessible via the WAN interface and allows remote access. The attacker accesses and controls the device through the telnet service. The Sitecom WLM-3500 and WLM-5500 are wireless router products developed by Sitecom. The Sitecom WLM-3500 and WLM-5500 devices generate WPA2 ciphertext and WEB administrator user passwords based on the MAC address of the wireless interface card. Attackers in the Wi-Fi network range can calculate the default wireless password and access device. Multiple Sitecom products are prone to multiple authentication-bypass vulnerabilities. \nAttackers can exploit these issues to gain unauthorized access to the device and perform unauthorized actions. This can lead to a complete compromise of the devices. \nThe following products are vulnerable:\nSitecom WLM-3500v2001 firmware 1.07\nSitecom WLM-5500v1001 firmware 1.15",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"db": "CNVD",
"id": "CNVD-2013-12606"
},
{
"db": "BID",
"id": "61829"
}
],
"trust": 1.35
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "61829",
"trust": 1.5
},
{
"db": "CNVD",
"id": "CNVD-2013-12607",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2013-12606",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"db": "CNVD",
"id": "CNVD-2013-12606"
},
{
"db": "BID",
"id": "61829"
}
]
},
"id": "VAR-201308-0494",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"db": "CNVD",
"id": "CNVD-2013-12606"
}
],
"trust": 2.2
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 1.2
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"db": "CNVD",
"id": "CNVD-2013-12606"
}
]
},
"last_update_date": "2022-05-17T02:01:13.917000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Sitecom N300/N600 undocumented Telnet service vulnerability patch",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/39157"
},
{
"title": "Sitecom N300/N600 WPA2/Patch for Managing Password Generation Algorithm Vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/39156"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"db": "CNVD",
"id": "CNVD-2013-12606"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.2,
"url": "http://www.securityfocus.com/archive/1/528093"
},
{
"trust": 1.2,
"url": "http://blog.emaze.net/2013/08/multiple-vulnerabilities-on-sitecom.html"
},
{
"trust": 0.3,
"url": "http://seclists.org/bugtraq/2013/aug/130"
},
{
"trust": 0.3,
"url": "http://www.sitecom.com"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"db": "CNVD",
"id": "CNVD-2013-12606"
},
{
"db": "BID",
"id": "61829"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"db": "CNVD",
"id": "CNVD-2013-12606"
},
{
"db": "BID",
"id": "61829"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-08-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"date": "2013-08-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-12606"
},
{
"date": "2013-08-19T00:00:00",
"db": "BID",
"id": "61829"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2013-08-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-12607"
},
{
"date": "2013-08-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2013-12606"
},
{
"date": "2013-08-19T00:00:00",
"db": "BID",
"id": "61829"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "network",
"sources": [
{
"db": "BID",
"id": "61829"
}
],
"trust": 0.3
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Sitecom N300/N600 Undocumented Telnet Service Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2013-12607"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "61829"
}
],
"trust": 0.3
}
}
VAR-201406-0502
Vulnerability from variot - Updated: 2022-05-17 01:47SITECOM WLR-4000/ WLR-4004 is a router. Multiple Sitecom products have an Admin cryptographic key security restriction bypass vulnerability, as the device generates a predictive way of managing passwords and WPA2 passphrases. Allows remote attackers to more easily obtain this information, allowing them to potentially access the device. This may lead to other attacks. The following products are vulnerable: Sitecom WLR-4000 v1 001 Sitecom WLR-4004 v1 001
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201406-0502",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wlr-4004",
"scope": "eq",
"trust": 0.6,
"vendor": "sitecom",
"version": "1.23"
},
{
"model": "wlr-4000",
"scope": "eq",
"trust": 0.6,
"vendor": "sitecom",
"version": "1.23"
},
{
"model": "wlr-4004",
"scope": "eq",
"trust": 0.3,
"vendor": "sitecom",
"version": "v10010"
},
{
"model": "wlr-4000",
"scope": "eq",
"trust": 0.3,
"vendor": "sitecom",
"version": "v10010"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03891"
},
{
"db": "BID",
"id": "67717"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Roberto Paleari and Alessandro Di Pinto",
"sources": [
{
"db": "BID",
"id": "67717"
}
],
"trust": 0.3
},
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CNVD-2014-03891",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "CNVD",
"id": "CNVD-2014-03891",
"trust": 0.6,
"value": "LOW"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03891"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "SITECOM WLR-4000/ WLR-4004 is a router. Multiple Sitecom products have an Admin cryptographic key security restriction bypass vulnerability, as the device generates a predictive way of managing passwords and WPA2 passphrases. Allows remote attackers to more easily obtain this information, allowing them to potentially access the device. This may lead to other attacks. \nThe following products are vulnerable:\nSitecom WLR-4000 v1 001\nSitecom WLR-4004 v1 001",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03891"
},
{
"db": "BID",
"id": "67717"
}
],
"trust": 0.81
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "67717",
"trust": 0.9
},
{
"db": "OSVDB",
"id": "107558",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2014-03891",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03891"
},
{
"db": "BID",
"id": "67717"
}
]
},
"id": "VAR-201406-0502",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03891"
}
],
"trust": 1.35
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03891"
}
]
},
"last_update_date": "2022-05-17T01:47:58.899000Z",
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 0.6,
"url": "http://www.osvdb.com/107558"
},
{
"trust": 0.3,
"url": "http://www.sitecom.com"
},
{
"trust": 0.3,
"url": "http://blog.emaze.net/2014/04/sitecom-firmware-and-wifi.html"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03891"
},
{
"db": "BID",
"id": "67717"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-03891"
},
{
"db": "BID",
"id": "67717"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-06-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03891"
},
{
"date": "2014-04-24T00:00:00",
"db": "BID",
"id": "67717"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-06-26T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03891"
},
{
"date": "2014-04-24T00:00:00",
"db": "BID",
"id": "67717"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "BID",
"id": "67717"
}
],
"trust": 0.3
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple Sitecom Products Admin Password Key Security Restriction Bypass Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03891"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "67717"
}
],
"trust": 0.3
}
}
CVE-2013-6786 (GCVE-0-2013-6786)
Vulnerability from nvd – Published: 2014-01-16 19:00 – Updated: 2024-08-06 17:46
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a "URL redirection" issue that some sources list separately.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://antoniovazquezblanco.github.io/docs/adviso… | x_refsource_MISC |
| http://osvdb.org/99694 | vdb-entryx_refsource_OSVDB |
| http://osvdb.org/ref/99/rompager407.pdf | x_refsource_MISC |
Date Public
2013-11-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:46:23.308Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf"
},
{
"name": "99694",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/99694"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://osvdb.org/ref/99/rompager407.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-11-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the \"forbidden author header\" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a \"URL redirection\" issue that some sources list separately."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-01-16T19:57:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf"
},
{
"name": "99694",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/99694"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://osvdb.org/ref/99/rompager407.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-6786",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the \"forbidden author header\" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a \"URL redirection\" issue that some sources list separately."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf",
"refsource": "MISC",
"url": "http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf"
},
{
"name": "99694",
"refsource": "OSVDB",
"url": "http://osvdb.org/99694"
},
{
"name": "http://osvdb.org/ref/99/rompager407.pdf",
"refsource": "MISC",
"url": "http://osvdb.org/ref/99/rompager407.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-6786",
"datePublished": "2014-01-16T19:00:00.000Z",
"dateReserved": "2013-11-12T00:00:00.000Z",
"dateUpdated": "2024-08-06T17:46:23.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1922 (GCVE-0-2012-1922)
Vulnerability from nvd – Published: 2013-01-24 01:00 – Updated: 2024-09-16 18:14
VLAI
EPSS
VEX
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.webapp-security.com/wp-content/uploads… | x_refsource_MISC |
| http://www.webapp-security.com/2012/03/sitecom-wl… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:26.877Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.webapp-security.com/wp-content/uploads/2012/03/Sitecom-WLM-2501-new-Multiple-CSRF-Vulnerabilities-1.txt"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-01-24T01:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.webapp-security.com/wp-content/uploads/2012/03/Sitecom-WLM-2501-new-Multiple-CSRF-Vulnerabilities-1.txt"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1922",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.webapp-security.com/wp-content/uploads/2012/03/Sitecom-WLM-2501-new-Multiple-CSRF-Vulnerabilities-1.txt",
"refsource": "MISC",
"url": "http://www.webapp-security.com/wp-content/uploads/2012/03/Sitecom-WLM-2501-new-Multiple-CSRF-Vulnerabilities-1.txt"
},
{
"name": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities",
"refsource": "MISC",
"url": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1922",
"datePublished": "2013-01-24T01:00:00.000Z",
"dateReserved": "2012-03-27T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:14:33.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1921 (GCVE-0-2012-1921)
Vulnerability from nvd – Published: 2012-08-26 20:00 – Updated: 2024-09-17 00:21
VLAI
EPSS
VEX
Summary
Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://ivanobinetti.blogspot.com/2012/03/sitecom-… | x_refsource_MISC |
| http://packetstormsecurity.org/files/110770/Sitec… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:26.890Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/110770/Sitecom-WLM-2501-Cross-Site-Request-Forgery.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-08-26T20:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/110770/Sitecom-WLM-2501-Cross-Site-Request-Forgery.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1921",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html",
"refsource": "MISC",
"url": "http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html"
},
{
"name": "http://packetstormsecurity.org/files/110770/Sitecom-WLM-2501-Cross-Site-Request-Forgery.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/files/110770/Sitecom-WLM-2501-Cross-Site-Request-Forgery.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1921",
"datePublished": "2012-08-26T20:00:00.000Z",
"dateReserved": "2012-03-27T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:21:37.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4503 (GCVE-0-2011-4503)
Vulnerability from nvd – Published: 2011-11-22 11:00 – Updated: 2024-09-16 19:56
VLAI
EPSS
VEX
Summary
The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.upnp-hacks.org/suspect.html | x_refsource_MISC |
| http://www.kb.cert.org/vuls/id/357851 | third-party-advisoryx_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:09:18.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-11-22T11:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4503",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.upnp-hacks.org/suspect.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/357851"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4503",
"datePublished": "2011-11-22T11:00:00.000Z",
"dateReserved": "2011-11-22T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:56:04.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4502 (GCVE-0-2011-4502)
Vulnerability from nvd – Published: 2011-11-22 11:00 – Updated: 2024-09-17 00:25
VLAI
EPSS
VEX
Summary
The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.upnp-hacks.org/devices.html | x_refsource_MISC |
| http://www.upnp-hacks.org/suspect.html | x_refsource_MISC |
| http://www.kb.cert.org/vuls/id/357851 | third-party-advisoryx_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:09:18.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-11-22T11:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4502",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.upnp-hacks.org/devices.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"name": "http://www.upnp-hacks.org/suspect.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/357851"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4502",
"datePublished": "2011-11-22T11:00:00.000Z",
"dateReserved": "2011-11-22T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:25:31.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4501 (GCVE-0-2011-4501)
Vulnerability from nvd – Published: 2011-11-22 11:00 – Updated: 2024-09-17 01:26
VLAI
EPSS
VEX
Summary
The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.upnp-hacks.org/devices.html | x_refsource_MISC |
| http://www.upnp-hacks.org/suspect.html | x_refsource_MISC |
| http://www.kb.cert.org/vuls/id/357851 | third-party-advisoryx_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:09:18.494Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-11-22T11:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4501",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.upnp-hacks.org/devices.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"name": "http://www.upnp-hacks.org/suspect.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/357851"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4501",
"datePublished": "2011-11-22T11:00:00.000Z",
"dateReserved": "2011-11-22T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:26:26.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2560 (GCVE-0-2006-2560)
Vulnerability from nvd – Published: 2006-05-24 01:00 – Updated: 2024-08-07 17:58
VLAI
EPSS
VEX
Summary
Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/20183 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityview.org/how-does-the-upnp-fla… | x_refsource_MISC |
| http://www.vupen.com/english/advisories/2006/1912 | vdb-entryx_refsource_VUPEN |
| http://www.securityview.org/dutch-student-finds-a… | x_refsource_MISC |
Date Public
2006-05-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:58:50.672Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20183"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securityview.org/how-does-the-upnp-flaw-works.html"
},
{
"name": "ADV-2006-1912",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1912"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-02-26T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20183"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securityview.org/how-does-the-upnp-flaw-works.html"
},
{
"name": "ADV-2006-1912",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1912"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2560",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20183",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20183"
},
{
"name": "http://www.securityview.org/how-does-the-upnp-flaw-works.html",
"refsource": "MISC",
"url": "http://www.securityview.org/how-does-the-upnp-flaw-works.html"
},
{
"name": "ADV-2006-1912",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1912"
},
{
"name": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html",
"refsource": "MISC",
"url": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2560",
"datePublished": "2006-05-24T01:00:00.000Z",
"dateReserved": "2006-05-23T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:58:50.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2013-6786 (GCVE-0-2013-6786)
Vulnerability from cvelistv5 – Published: 2014-01-16 19:00 – Updated: 2024-08-06 17:46
VLAI
EPSS
VEX
Summary
Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the "forbidden author header" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a "URL redirection" issue that some sources list separately.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://antoniovazquezblanco.github.io/docs/adviso… | x_refsource_MISC |
| http://osvdb.org/99694 | vdb-entryx_refsource_OSVDB |
| http://osvdb.org/ref/99/rompager407.pdf | x_refsource_MISC |
Date Public
2013-11-12 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T17:46:23.308Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf"
},
{
"name": "99694",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://osvdb.org/99694"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://osvdb.org/ref/99/rompager407.pdf"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-11-12T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the \"forbidden author header\" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a \"URL redirection\" issue that some sources list separately."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-01-16T19:57:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf"
},
{
"name": "99694",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://osvdb.org/99694"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://osvdb.org/ref/99/rompager407.pdf"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2013-6786",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Allegro RomPager before 4.51, as used on the ZyXEL P660HW-D1, Huawei MT882, Sitecom WL-174, TP-LINK TD-8816, and D-Link DSL-2640R and DSL-2641R, when the \"forbidden author header\" protection mechanism is bypassed, allows remote attackers to inject arbitrary web script or HTML by requesting a nonexistent URI in conjunction with a crafted HTTP Referer header that is not properly handled in a 404 page. NOTE: there is no CVE for a \"URL redirection\" issue that some sources list separately."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf",
"refsource": "MISC",
"url": "http://antoniovazquezblanco.github.io/docs/advisories/Advisory_RomPagerXSS.pdf"
},
{
"name": "99694",
"refsource": "OSVDB",
"url": "http://osvdb.org/99694"
},
{
"name": "http://osvdb.org/ref/99/rompager407.pdf",
"refsource": "MISC",
"url": "http://osvdb.org/ref/99/rompager407.pdf"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2013-6786",
"datePublished": "2014-01-16T19:00:00.000Z",
"dateReserved": "2013-11-12T00:00:00.000Z",
"dateUpdated": "2024-08-06T17:46:23.308Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1922 (GCVE-0-2012-1922)
Vulnerability from cvelistv5 – Published: 2013-01-24 01:00 – Updated: 2024-09-16 18:14
VLAI
EPSS
VEX
Summary
Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.webapp-security.com/wp-content/uploads… | x_refsource_MISC |
| http://www.webapp-security.com/2012/03/sitecom-wl… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:26.877Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.webapp-security.com/wp-content/uploads/2012/03/Sitecom-WLM-2501-new-Multiple-CSRF-Vulnerabilities-1.txt"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2013-01-24T01:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.webapp-security.com/wp-content/uploads/2012/03/Sitecom-WLM-2501-new-Multiple-CSRF-Vulnerabilities-1.txt"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1922",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Multiple cross-site request forgery (CSRF) vulnerabilities in Sitecom WLM-2501 allow remote attackers to hijack the authentication of administrators for requests that modify settings for (1) Mac Filtering via admin/formFilter, (2) IP/Port Filtering via formFilter, (3) Port Forwarding via formPortFw, (4) Wireless Access Control via admin/formWlAc, (5) Wi-Fi Protected Setup via formWsc, (6) URL Blocking Filter via formURL, (7) Domain Blocking Filter via formDOMAINBLK, and (8) IP Address ACL Filter via admin/formACL in goform/, different vectors than CVE-2012-1921."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.webapp-security.com/wp-content/uploads/2012/03/Sitecom-WLM-2501-new-Multiple-CSRF-Vulnerabilities-1.txt",
"refsource": "MISC",
"url": "http://www.webapp-security.com/wp-content/uploads/2012/03/Sitecom-WLM-2501-new-Multiple-CSRF-Vulnerabilities-1.txt"
},
{
"name": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities",
"refsource": "MISC",
"url": "http://www.webapp-security.com/2012/03/sitecom-wlm-2501-multiple-csrf-vulnerabilities"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1922",
"datePublished": "2013-01-24T01:00:00.000Z",
"dateReserved": "2012-03-27T00:00:00.000Z",
"dateUpdated": "2024-09-16T18:14:33.386Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2012-1921 (GCVE-0-2012-1921)
Vulnerability from cvelistv5 – Published: 2012-08-26 20:00 – Updated: 2024-09-17 00:21
VLAI
EPSS
VEX
Summary
Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://ivanobinetti.blogspot.com/2012/03/sitecom-… | x_refsource_MISC |
| http://packetstormsecurity.org/files/110770/Sitec… | x_refsource_MISC |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T19:17:26.890Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://packetstormsecurity.org/files/110770/Sitecom-WLM-2501-Cross-Site-Request-Forgery.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2012-08-26T20:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://packetstormsecurity.org/files/110770/Sitecom-WLM-2501-Cross-Site-Request-Forgery.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-1921",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site request forgery (CSRF) vulnerability in goform/admin/formWlEncrypt in Sitecom WLM-2501 allows remote attackers to hijack the authentication of administrators for requests that change the router passphrase via the pskValue parameter."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html",
"refsource": "MISC",
"url": "http://ivanobinetti.blogspot.com/2012/03/sitecom-wlm-2501-change-wireless.html"
},
{
"name": "http://packetstormsecurity.org/files/110770/Sitecom-WLM-2501-Cross-Site-Request-Forgery.html",
"refsource": "MISC",
"url": "http://packetstormsecurity.org/files/110770/Sitecom-WLM-2501-Cross-Site-Request-Forgery.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-1921",
"datePublished": "2012-08-26T20:00:00.000Z",
"dateReserved": "2012-03-27T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:21:37.925Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4503 (GCVE-0-2011-4503)
Vulnerability from cvelistv5 – Published: 2011-11-22 11:00 – Updated: 2024-09-16 19:56
VLAI
EPSS
VEX
Summary
The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
2 references
| URL | Tags |
|---|---|
| http://www.upnp-hacks.org/suspect.html | x_refsource_MISC |
| http://www.kb.cert.org/vuls/id/357851 | third-party-advisoryx_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:09:18.512Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-11-22T11:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4503",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.upnp-hacks.org/suspect.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/357851"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4503",
"datePublished": "2011-11-22T11:00:00.000Z",
"dateReserved": "2011-11-22T00:00:00.000Z",
"dateUpdated": "2024-09-16T19:56:04.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4502 (GCVE-0-2011-4502)
Vulnerability from cvelistv5 – Published: 2011-11-22 11:00 – Updated: 2024-09-17 00:25
VLAI
EPSS
VEX
Summary
The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.upnp-hacks.org/devices.html | x_refsource_MISC |
| http://www.upnp-hacks.org/suspect.html | x_refsource_MISC |
| http://www.kb.cert.org/vuls/id/357851 | third-party-advisoryx_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:09:18.491Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-11-22T11:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4502",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.upnp-hacks.org/devices.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"name": "http://www.upnp-hacks.org/suspect.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/357851"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4502",
"datePublished": "2011-11-22T11:00:00.000Z",
"dateReserved": "2011-11-22T00:00:00.000Z",
"dateUpdated": "2024-09-17T00:25:31.564Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2011-4501 (GCVE-0-2011-4501)
Vulnerability from cvelistv5 – Published: 2011-11-22 11:00 – Updated: 2024-09-17 01:26
VLAI
EPSS
VEX
Summary
The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| http://www.upnp-hacks.org/devices.html | x_refsource_MISC |
| http://www.upnp-hacks.org/suspect.html | x_refsource_MISC |
| http://www.kb.cert.org/vuls/id/357851 | third-party-advisoryx_refsource_CERT-VN |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T00:09:18.494Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN",
"x_transferred"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2011-11-22T11:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"tags": [
"third-party-advisory",
"x_refsource_CERT-VN"
],
"url": "http://www.kb.cert.org/vuls/id/357851"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2011-4501",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.upnp-hacks.org/devices.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"name": "http://www.upnp-hacks.org/suspect.html",
"refsource": "MISC",
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"name": "VU#357851",
"refsource": "CERT-VN",
"url": "http://www.kb.cert.org/vuls/id/357851"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2011-4501",
"datePublished": "2011-11-22T11:00:00.000Z",
"dateReserved": "2011-11-22T00:00:00.000Z",
"dateUpdated": "2024-09-17T01:26:26.089Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2006-2560 (GCVE-0-2006-2560)
Vulnerability from cvelistv5 – Published: 2006-05-24 01:00 – Updated: 2024-08-07 17:58
VLAI
EPSS
VEX
Summary
Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
4 references
| URL | Tags |
|---|---|
| http://secunia.com/advisories/20183 | third-party-advisoryx_refsource_SECUNIA |
| http://www.securityview.org/how-does-the-upnp-fla… | x_refsource_MISC |
| http://www.vupen.com/english/advisories/2006/1912 | vdb-entryx_refsource_VUPEN |
| http://www.securityview.org/dutch-student-finds-a… | x_refsource_MISC |
Date Public
2006-05-22 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-07T17:58:50.672Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "20183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/20183"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securityview.org/how-does-the-upnp-flaw-works.html"
},
{
"name": "ADV-2006-1912",
"tags": [
"vdb-entry",
"x_refsource_VUPEN",
"x_transferred"
],
"url": "http://www.vupen.com/english/advisories/2006/1912"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2006-05-22T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2009-02-26T10:00:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"name": "20183",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/20183"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securityview.org/how-does-the-upnp-flaw-works.html"
},
{
"name": "ADV-2006-1912",
"tags": [
"vdb-entry",
"x_refsource_VUPEN"
],
"url": "http://www.vupen.com/english/advisories/2006/1912"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2006-2560",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "20183",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/20183"
},
{
"name": "http://www.securityview.org/how-does-the-upnp-flaw-works.html",
"refsource": "MISC",
"url": "http://www.securityview.org/how-does-the-upnp-flaw-works.html"
},
{
"name": "ADV-2006-1912",
"refsource": "VUPEN",
"url": "http://www.vupen.com/english/advisories/2006/1912"
},
{
"name": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html",
"refsource": "MISC",
"url": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2006-2560",
"datePublished": "2006-05-24T01:00:00.000Z",
"dateReserved": "2006-05-23T00:00:00.000Z",
"dateUpdated": "2024-08-07T17:58:50.672Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}