VAR-200605-0268

Vulnerability from variot - Updated: 2024-02-14 23:06

ZyXEL P-335WT router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic. For example, use AddPortMapping to forward arbitrary traffic. P-335Wt Router is prone to a security bypass vulnerability.

TITLE: ZyXEL P-335WT UPnP Port Mapping Vulnerability

SECUNIA ADVISORY ID: SA20184

VERIFY ADVISORY: http://secunia.com/advisories/20184/

CRITICAL: Less critical

IMPACT: Security Bypass

WHERE:

From local network

OPERATING SYSTEM: ZyXEL P-335WT http://secunia.com/product/10055/

DESCRIPTION: Armijn Hemel has reported a vulnerability in ZyXEL P-335WT, which can be exploited by malicious people to bypass certain security restrictions.

The vulnerability is related to: SA20161

SOLUTION: Disable the UPnP functionality if it is not required.

UPnP is reportedly disabled by default.

PROVIDED AND/OR DISCOVERED BY: Armijn Hemel

OTHER REFERENCES: SA20161: http://secunia.com/advisories/20161/

About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.

Subscribe: http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/

Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.

Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Show details on source website
To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-200605-0268",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "p-335wt router",
        "scope": "eq",
        "trust": 1.0,
        "vendor": "zyxel",
        "version": "*"
      },
      {
        "model": null,
        "scope": null,
        "trust": 0.6,
        "vendor": "no",
        "version": null
      },
      {
        "model": "p-335wt router",
        "scope": null,
        "trust": 0.6,
        "vendor": "zyxel",
        "version": null
      },
      {
        "model": "p-335wt router",
        "scope": "eq",
        "trust": 0.3,
        "vendor": "zyxel",
        "version": "0"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      },
      {
        "db": "BID",
        "id": "87572"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-434"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2562"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:h:zyxel:p-335wt_router:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-2562"
      }
    ]
  },
  "credits": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/credits#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Unknown",
    "sources": [
      {
        "db": "BID",
        "id": "87572"
      }
    ],
    "trust": 0.3
  },
  "cve": "CVE-2006-2562",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "acInsufInfo": false,
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "NVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "obtainAllPrivilege": false,
            "obtainOtherPrivilege": true,
            "obtainUserPrivilege": false,
            "severity": "HIGH",
            "trust": 1.0,
            "userInteractionRequired": false,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "CNVD",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "CNVD-2006-3383",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "author": "VULHUB",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "exploitabilityScore": 10.0,
            "id": "VHN-18670",
            "impactScore": 6.4,
            "integrityImpact": "PARTIAL",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
            "version": "2.0"
          }
        ],
        "cvssV3": [],
        "severity": [
          {
            "author": "NVD",
            "id": "CVE-2006-2562",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2006-3383",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-200605-434",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-18670",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      },
      {
        "db": "VULHUB",
        "id": "VHN-18670"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-434"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2562"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "ZyXEL P-335WT router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic. For example, use AddPortMapping to forward arbitrary traffic. P-335Wt Router is prone to a security bypass vulnerability. \n\nTITLE:\nZyXEL P-335WT UPnP Port Mapping Vulnerability\n\nSECUNIA ADVISORY ID:\nSA20184\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/20184/\n\nCRITICAL:\nLess critical\n\nIMPACT:\nSecurity Bypass\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nZyXEL P-335WT\nhttp://secunia.com/product/10055/\n\nDESCRIPTION:\nArmijn Hemel has reported a vulnerability in ZyXEL P-335WT, which can\nbe exploited by malicious people to bypass certain security\nrestrictions. \n\nThe vulnerability is related to:\nSA20161\n\nSOLUTION:\nDisable the UPnP functionality if it is not required. \n\nUPnP is reportedly disabled by default. \n\nPROVIDED AND/OR DISCOVERED BY:\nArmijn Hemel\n\nOTHER REFERENCES:\nSA20161:\nhttp://secunia.com/advisories/20161/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2006-2562"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      },
      {
        "db": "BID",
        "id": "87572"
      },
      {
        "db": "VULHUB",
        "id": "VHN-18670"
      },
      {
        "db": "PACKETSTORM",
        "id": "46539"
      }
    ],
    "trust": 1.89
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2006-2562",
        "trust": 2.6
      },
      {
        "db": "SECUNIA",
        "id": "20184",
        "trust": 2.4
      },
      {
        "db": "VUPEN",
        "id": "ADV-2006-1910",
        "trust": 1.7
      },
      {
        "db": "XF",
        "id": "26710",
        "trust": 0.9
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-434",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383",
        "trust": 0.6
      },
      {
        "db": "BID",
        "id": "87572",
        "trust": 0.4
      },
      {
        "db": "VULHUB",
        "id": "VHN-18670",
        "trust": 0.1
      },
      {
        "db": "PACKETSTORM",
        "id": "46539",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      },
      {
        "db": "VULHUB",
        "id": "VHN-18670"
      },
      {
        "db": "BID",
        "id": "87572"
      },
      {
        "db": "PACKETSTORM",
        "id": "46539"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-434"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2562"
      }
    ]
  },
  "id": "VAR-200605-0268",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      },
      {
        "db": "VULHUB",
        "id": "VHN-18670"
      }
    ],
    "trust": 0.06999999999999999
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      }
    ]
  },
  "last_update_date": "2024-02-14T23:06:59.761000Z",
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-264",
        "trust": 1.1
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-18670"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2562"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 2.3,
        "url": "http://secunia.com/advisories/20184"
      },
      {
        "trust": 2.0,
        "url": "http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.html"
      },
      {
        "trust": 2.0,
        "url": "http://www.securityview.org/how-does-the-upnp-flaw-works.html"
      },
      {
        "trust": 1.1,
        "url": "http://www.vupen.com/english/advisories/2006/1910"
      },
      {
        "trust": 1.1,
        "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/26710"
      },
      {
        "trust": 0.9,
        "url": "http://xforce.iss.net/xforce/xfdb/26710"
      },
      {
        "trust": 0.6,
        "url": "http://www.frsirt.com/english/advisories/2006/1910"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/product/10055/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/secunia_security_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/about_secunia_advisories/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/20184/"
      },
      {
        "trust": 0.1,
        "url": "http://secunia.com/advisories/20161/"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      },
      {
        "db": "VULHUB",
        "id": "VHN-18670"
      },
      {
        "db": "BID",
        "id": "87572"
      },
      {
        "db": "PACKETSTORM",
        "id": "46539"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-434"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2562"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      },
      {
        "db": "VULHUB",
        "id": "VHN-18670"
      },
      {
        "db": "BID",
        "id": "87572"
      },
      {
        "db": "PACKETSTORM",
        "id": "46539"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-434"
      },
      {
        "db": "NVD",
        "id": "CVE-2006-2562"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2006-05-23T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      },
      {
        "date": "2006-05-24T00:00:00",
        "db": "VULHUB",
        "id": "VHN-18670"
      },
      {
        "date": "2006-05-23T00:00:00",
        "db": "BID",
        "id": "87572"
      },
      {
        "date": "2006-05-23T05:09:34",
        "db": "PACKETSTORM",
        "id": "46539"
      },
      {
        "date": "2006-05-23T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200605-434"
      },
      {
        "date": "2006-05-24T01:02:00",
        "db": "NVD",
        "id": "CVE-2006-2562"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2006-05-23T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      },
      {
        "date": "2017-07-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-18670"
      },
      {
        "date": "2006-05-23T00:00:00",
        "db": "BID",
        "id": "87572"
      },
      {
        "date": "2007-01-24T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-200605-434"
      },
      {
        "date": "2024-02-14T01:17:43.863000",
        "db": "NVD",
        "id": "CVE-2006-2562"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-434"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "ZyXEL P-335WT Router UPnP Request Access Control Bypass Vulnerability",
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2006-3383"
      }
    ],
    "trust": 0.6
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "permissions and access control",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-200605-434"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.