Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
51 vulnerabilities by thomson
VAR-201407-0057
Vulnerability from variot - Updated: 2023-12-18 13:53Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authentication of unspecified victims for requests that change passwords via the Password and PasswordReEnter parameters to goform/RgSecurity. The Thomson TWG87OUIR router is a router device. An attacker may leverage this issue to perform certain unauthorized actions. This may lead to further attacks
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201407-0057",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "twg87ouir",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": null
},
{
"model": "twg87ouir",
"scope": null,
"trust": 0.8,
"vendor": "thomson",
"version": null
},
{
"model": "twg87ouir router",
"scope": null,
"trust": 0.6,
"vendor": "thomson",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03985"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003204"
},
{
"db": "NVD",
"id": "CVE-2014-4716"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:thomson:twg87ouir:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2014-4716"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "nopesled",
"sources": [
{
"db": "BID",
"id": "68216"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
],
"trust": 0.9
},
"cve": "CVE-2014-4716",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 8.6,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 6.8,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2014-4716",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.8,
"id": "CNVD-2014-03985",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2014-4716",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2014-03985",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201406-709",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03985"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003204"
},
{
"db": "NVD",
"id": "CVE-2014-4716"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site request forgery (CSRF) vulnerability in Thomson TWG87OUIR allows remote attackers to hijack the authentication of unspecified victims for requests that change passwords via the Password and PasswordReEnter parameters to goform/RgSecurity. The Thomson TWG87OUIR router is a router device. \nAn attacker may leverage this issue to perform certain unauthorized actions. This may lead to further attacks",
"sources": [
{
"db": "NVD",
"id": "CVE-2014-4716"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003204"
},
{
"db": "CNVD",
"id": "CNVD-2014-03985"
},
{
"db": "BID",
"id": "68216"
}
],
"trust": 2.43
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "OSVDB",
"id": "108397",
"trust": 3.0
},
{
"db": "NVD",
"id": "CVE-2014-4716",
"trust": 2.7
},
{
"db": "EXPLOIT-DB",
"id": "33866",
"trust": 2.2
},
{
"db": "PACKETSTORM",
"id": "127244",
"trust": 1.6
},
{
"db": "BID",
"id": "68216",
"trust": 1.5
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003204",
"trust": 0.8
},
{
"db": "EXPLOITDB",
"id": "33866",
"trust": 0.6
},
{
"db": "CNVD",
"id": "CNVD-2014-03985",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201406-709",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03985"
},
{
"db": "BID",
"id": "68216"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003204"
},
{
"db": "NVD",
"id": "CVE-2014-4716"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
]
},
"id": "VAR-201407-0057",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03985"
}
],
"trust": 1.6
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03985"
}
]
},
"last_update_date": "2023-12-18T13:53:22.311000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Thomson TWG87OUIR Router \u0027/goform/RgSecurity\u0027 patch for cross-site request forgery vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/46930"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03985"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003204"
},
{
"db": "NVD",
"id": "CVE-2014-4716"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.4,
"url": "http://osvdb.org/show/osvdb/108397"
},
{
"trust": 1.6,
"url": "http://packetstormsecurity.com/files/127244/thomson-twg87ouir-cross-site-request-forgery.html"
},
{
"trust": 1.6,
"url": "http://www.exploit-db.com/exploits/33866"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4716"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4716"
},
{
"trust": 0.6,
"url": "http://www.exploit-db.com/exploits/33866/"
},
{
"trust": 0.6,
"url": "http://osvdb.com/show/osvdb/108397"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/bid/68216"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2014-03985"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003204"
},
{
"db": "NVD",
"id": "CVE-2014-4716"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2014-03985"
},
{
"db": "BID",
"id": "68216"
},
{
"db": "JVNDB",
"id": "JVNDB-2014-003204"
},
{
"db": "NVD",
"id": "CVE-2014-4716"
},
{
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03985"
},
{
"date": "2014-06-26T00:00:00",
"db": "BID",
"id": "68216"
},
{
"date": "2014-07-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003204"
},
{
"date": "2014-07-03T14:55:08.847000",
"db": "NVD",
"id": "CVE-2014-4716"
},
{
"date": "2014-06-26T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2014-07-02T00:00:00",
"db": "CNVD",
"id": "CNVD-2014-03985"
},
{
"date": "2014-07-08T00:55:00",
"db": "BID",
"id": "68216"
},
{
"date": "2014-07-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2014-003204"
},
{
"date": "2014-07-07T13:57:16.420000",
"db": "NVD",
"id": "CVE-2014-4716"
},
{
"date": "2014-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson TWG87OUIR Vulnerable to cross-site request forgery",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2014-003204"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201406-709"
}
],
"trust": 0.6
}
}
VAR-200312-0278
Vulnerability from variot - Updated: 2023-12-18 13:35The HTTP server in the Thomson TWC305, TWC315, and TCW690 cable modem ST42.03.0a allows remote attackers to cause a denial of service (unstable service) via a long GET request, possibly caused by a buffer overflow. A problem has been identified in Thomson Cable Modems when handling long requests on the HTTP port. Because of this, it may be possible for an attacker to deny service to legitimate users of the device. Thomson TCM315 is a broadband wired MODEM device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200312-0278",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tcw cable modem",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "690"
},
{
"model": "tcm cable modem",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "315"
},
{
"model": "tcm cable modem",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "305"
},
{
"model": "tcw cable modem",
"scope": "eq",
"trust": 0.6,
"vendor": "thomson",
"version": "690_st42.03.0a"
},
{
"model": "tcw690 cable modem st42.03.0a",
"scope": null,
"trust": 0.3,
"vendor": "thomson",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "9091"
},
{
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:thomson:tcm_cable_modem:305:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:thomson:tcm_cable_modem:315:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:thomson:tcw_cable_modem:690:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
},
{
"cpe23Uri": "cpe:2.3:h:thomson:tcw_cable_modem:690_st42.03.0a:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2003-1085"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Andr\u00e9s Tarasc\u00f3\u203b admin@shellsec.net",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
],
"trust": 0.6
},
"cve": "CVE-2003-1085",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-7910",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2003-1085",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200312-257",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-7910",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-7910"
},
{
"db": "NVD",
"id": "CVE-2003-1085"
},
{
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The HTTP server in the Thomson TWC305, TWC315, and TCW690 cable modem ST42.03.0a allows remote attackers to cause a denial of service (unstable service) via a long GET request, possibly caused by a buffer overflow. A problem has been identified in Thomson Cable Modems when handling long requests on the HTTP port. Because of this, it may be possible for an attacker to deny service to legitimate users of the device. Thomson TCM315 is a broadband wired MODEM device",
"sources": [
{
"db": "NVD",
"id": "CVE-2003-1085"
},
{
"db": "BID",
"id": "9091"
},
{
"db": "VULHUB",
"id": "VHN-7910"
}
],
"trust": 1.26
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-7910",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-7910"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "9091",
"trust": 2.0
},
{
"db": "NVD",
"id": "CVE-2003-1085",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "10286",
"trust": 1.7
},
{
"db": "SECUNIA",
"id": "14353",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200312-257",
"trust": 0.7
},
{
"db": "XF",
"id": "13815",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20031124 THOMNSON TCM315 DENIAL OF SERVICE",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20031123 THOMNSON TCM315 DENIAL OF SERVICE",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20050219 THOMSON TCW690 DENIAL OF SERVICE VULNERABILITY",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20031123 THOMNSON TCM315 DENIAL OF SERVICE",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20050219 RE: [FULL-DISCLOSURE] THOMSON TCW690 DENIAL OF SERVICE VULNERABILITY",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "5724",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "25124",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-78791",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-7910",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-7910"
},
{
"db": "BID",
"id": "9091"
},
{
"db": "NVD",
"id": "CVE-2003-1085"
},
{
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
]
},
"id": "VAR-200312-0278",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-7910"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:35:50.565000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2003-1085"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/9091"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/archive/1/345414"
},
{
"trust": 1.7,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-november/014062.html"
},
{
"trust": 1.7,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2003-november/014068.html"
},
{
"trust": 1.7,
"url": "http://www.shellsec.net/leer_advisory.php?id=2"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/10286"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/14353"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/13815"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=110888093214678\u0026w=2"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=full-disclosure\u0026m=110880725322192\u0026w=2"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/13815"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=full-disclosure\u0026m=110880725322192\u0026w=2"
},
{
"trust": 0.6,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=110888093214678\u0026w=2"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/5724"
},
{
"trust": 0.3,
"url": "http://archives.neohapsis.com/archives/fulldisclosure/2003-q4/2826.html"
},
{
"trust": 0.3,
"url": "/archive/1/345414"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=110888093214678\u0026amp;w=2"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=full-disclosure\u0026amp;m=110880725322192\u0026amp;w=2"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-7910"
},
{
"db": "BID",
"id": "9091"
},
{
"db": "NVD",
"id": "CVE-2003-1085"
},
{
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-7910"
},
{
"db": "BID",
"id": "9091"
},
{
"db": "NVD",
"id": "CVE-2003-1085"
},
{
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2003-12-31T00:00:00",
"db": "VULHUB",
"id": "VHN-7910"
},
{
"date": "2003-11-24T00:00:00",
"db": "BID",
"id": "9091"
},
{
"date": "2003-12-31T05:00:00",
"db": "NVD",
"id": "CVE-2003-1085"
},
{
"date": "2003-11-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-11T00:00:00",
"db": "VULHUB",
"id": "VHN-7910"
},
{
"date": "2009-07-12T00:56:00",
"db": "BID",
"id": "9091"
},
{
"date": "2017-07-11T01:29:43.760000",
"db": "NVD",
"id": "CVE-2003-1085"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson Cable Modem Remote Denial of Service Attack Vulnerability",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Boundary Condition Error",
"sources": [
{
"db": "BID",
"id": "9091"
},
{
"db": "CNNVD",
"id": "CNNVD-200312-257"
}
],
"trust": 0.9
}
}
VAR-200502-0054
Vulnerability from variot - Updated: 2023-12-18 13:35The RgSecurity form in the HTTP server for the Thomson TCW690 cable modem running firmware 2.1 and software ST42.03.0a does not properly validate the password before performing changes, which allows remote attackers on the LAN to gain access via a direct POST request. Thomson Cable Modem is prone to a denial-of-service vulnerability
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200502-0054",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cable modem",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "tcw690"
},
{
"model": "cable modem tcw690",
"scope": null,
"trust": 0.3,
"vendor": "thomson",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "90229"
},
{
"db": "NVD",
"id": "CVE-2005-0494"
},
{
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:thomson:thomson_cable_modem:tcw690:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-0494"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "90229"
}
],
"trust": 0.3
},
"cve": "CVE-2005-0494",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-11703",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2005-0494",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200502-073",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-11703",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-11703"
},
{
"db": "NVD",
"id": "CVE-2005-0494"
},
{
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The RgSecurity form in the HTTP server for the Thomson TCW690 cable modem running firmware 2.1 and software ST42.03.0a does not properly validate the password before performing changes, which allows remote attackers on the LAN to gain access via a direct POST request. Thomson Cable Modem is prone to a denial-of-service vulnerability",
"sources": [
{
"db": "NVD",
"id": "CVE-2005-0494"
},
{
"db": "BID",
"id": "90229"
},
{
"db": "VULHUB",
"id": "VHN-11703"
}
],
"trust": 1.26
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-11703",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-11703"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2005-0494",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "14353",
"trust": 1.7
},
{
"db": "XF",
"id": "19387",
"trust": 0.9
},
{
"db": "CNNVD",
"id": "CNNVD-200502-073",
"trust": 0.7
},
{
"db": "XF",
"id": "690",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20050219 THOMSON TCW690 POST PASSWORD VALIDATION VULNERABILITY",
"trust": 0.6
},
{
"db": "BID",
"id": "90229",
"trust": 0.4
},
{
"db": "EXPLOIT-DB",
"id": "829",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-11703",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-11703"
},
{
"db": "BID",
"id": "90229"
},
{
"db": "NVD",
"id": "CVE-2005-0494"
},
{
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
]
},
"id": "VAR-200502-0054",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-11703"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T13:35:50.539000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2005-0494"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://secunia.com/advisories/14353"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/19387"
},
{
"trust": 1.0,
"url": "http://marc.info/?l=bugtraq\u0026m=110886937131507\u0026w=2"
},
{
"trust": 0.9,
"url": "http://marc.theaimsgroup.com/?l=bugtraq\u0026m=110886937131507\u0026w=2"
},
{
"trust": 0.9,
"url": "http://xforce.iss.net/xforce/xfdb/19387"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=110886937131507\u0026amp;w=2"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-11703"
},
{
"db": "BID",
"id": "90229"
},
{
"db": "NVD",
"id": "CVE-2005-0494"
},
{
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-11703"
},
{
"db": "BID",
"id": "90229"
},
{
"db": "NVD",
"id": "CVE-2005-0494"
},
{
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2005-02-21T00:00:00",
"db": "VULHUB",
"id": "VHN-11703"
},
{
"date": "2005-02-21T00:00:00",
"db": "BID",
"id": "90229"
},
{
"date": "2005-02-21T05:00:00",
"db": "NVD",
"id": "CVE-2005-0494"
},
{
"date": "2005-02-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-11T00:00:00",
"db": "VULHUB",
"id": "VHN-11703"
},
{
"date": "2005-02-21T00:00:00",
"db": "BID",
"id": "90229"
},
{
"date": "2017-07-11T01:32:19.593000",
"db": "NVD",
"id": "CVE-2005-0494"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomason cable modem RgSecurity Form Verification Remote Attack Vulnerability",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "unknown",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200502-073"
}
],
"trust": 0.6
}
}
VAR-200603-0483
Vulnerability from variot - Updated: 2023-12-18 13:25Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in the "31" parameter in a NewUser function, which is not filtered by the modem when creating the account, but cannot be deleted by the administrator, possibly due to cleansing that occurs in the administrator interface. The SpeedTouch 500 series are prone to a cross-site scripting vulnerability. This issue is due to a failure in the devices to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the compromise of the device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200603-0483",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "580_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "546_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "585_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "536_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "530_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "516_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "576_5.3.2.6.0"
},
{
"model": "thomson 516 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 530 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 536 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 546 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 576 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 580 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 585 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5855.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5805.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5765.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5465.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5365.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5305.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5165.3.2.6.0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "NVD",
"id": "CVE-2006-0947"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:546_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:576_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:530_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:536_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:580_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:585_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:516_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-0947"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Preben Nyl?kken is credited with the discovery of this vulnerability.",
"sources": [
{
"db": "BID",
"id": "16839"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
],
"trust": 0.9
},
"cve": "CVE-2006-0947",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": true,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CNVD-2006-1177",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.6,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-17055",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2006-0947",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2006-1177",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200602-411",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-17055",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"db": "VULHUB",
"id": "VHN-17055"
},
{
"db": "NVD",
"id": "CVE-2006-0947"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson SpeedTouch modem running firmware 5.3.2.6.0 allows remote attackers to create users that cannot be deleted via scripting code in the \"31\" parameter in a NewUser function, which is not filtered by the modem when creating the account, but cannot be deleted by the administrator, possibly due to cleansing that occurs in the administrator interface. The SpeedTouch 500 series are prone to a cross-site scripting vulnerability. This issue is due to a failure in the devices to properly sanitize user-supplied input. \nAn attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the compromise of the device",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-0947"
},
{
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "VULHUB",
"id": "VHN-17055"
}
],
"trust": 1.8
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-17055",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-17055"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "16839",
"trust": 2.6
},
{
"db": "NVD",
"id": "CVE-2006-0947",
"trust": 2.3
},
{
"db": "SECUNIA",
"id": "19069",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2006-0765",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1015688",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200602-411",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2006-1177",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20060226 THOMSON SPEEDTOUCH 500 MODEMS VULNERABLE TO XSS",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "27319",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-80932",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-17055",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"db": "VULHUB",
"id": "VHN-17055"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "NVD",
"id": "CVE-2006-0947"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
]
},
"id": "VAR-200603-0483",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"db": "VULHUB",
"id": "VHN-17055"
}
],
"trust": 1.676190457142857
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1177"
}
]
},
"last_update_date": "2023-12-18T13:25:57.381000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-0947"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/16839"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/archive/1/426186"
},
{
"trust": 1.7,
"url": "http://securitytracker.com/id?1015688"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/19069"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2006/0765"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/0765"
},
{
"trust": 0.3,
"url": "http://www.speedtouchdsl.com/homeprod_dsl.htm"
},
{
"trust": 0.3,
"url": "/archive/1/426186"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"db": "VULHUB",
"id": "VHN-17055"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "NVD",
"id": "CVE-2006-0947"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"db": "VULHUB",
"id": "VHN-17055"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "NVD",
"id": "CVE-2006-0947"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-02-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"date": "2006-03-01T00:00:00",
"db": "VULHUB",
"id": "VHN-17055"
},
{
"date": "2006-02-25T00:00:00",
"db": "BID",
"id": "16839"
},
{
"date": "2006-03-01T02:02:00",
"db": "NVD",
"id": "CVE-2006-0947"
},
{
"date": "2006-02-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-02-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"date": "2011-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-17055"
},
{
"date": "2006-03-01T05:16:00",
"db": "BID",
"id": "16839"
},
{
"date": "2011-03-08T02:31:25.737000",
"db": "NVD",
"id": "CVE-2006-0947"
},
{
"date": "2006-03-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson SpeedTouch 500 Series Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1177"
},
{
"db": "BID",
"id": "16839"
}
],
"trust": 0.9
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "input validation",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200602-411"
}
],
"trust": 0.6
}
}
VAR-200603-0482
Vulnerability from variot - Updated: 2023-12-18 13:25Cross-site scripting (XSS) vulnerability in Thomson SpeedTouch modems running firmware 5.3.2.6.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter to the LocalNetwork page. The SpeedTouch 500 series are prone to a cross-site scripting vulnerability. This issue is due to a failure in the devices to properly sanitize user-supplied input. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the compromise of the device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200603-0482",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "580_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "546_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "585_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "536_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "530_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "516_5.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "576_5.3.2.6.0"
},
{
"model": "thomson 516 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 530 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 536 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 546 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 576 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 580 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "thomson 585 5.3.2.6.0",
"scope": null,
"trust": 0.6,
"vendor": "speedtouch",
"version": null
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5855.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5805.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5765.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5465.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5365.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5305.3.2.6.0"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "5165.3.2.6.0"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "NVD",
"id": "CVE-2006-0946"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:546_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:576_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:530_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:536_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:580_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:585_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:516_5.3.2.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-0946"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Preben Nyl?kken is credited with the discovery of this vulnerability.",
"sources": [
{
"db": "BID",
"id": "16839"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
],
"trust": 0.9
},
"cve": "CVE-2006-0946",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "CNVD-2006-1160",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-17054",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2006-0946",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2006-1160",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200602-430",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-17054",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"db": "VULHUB",
"id": "VHN-17054"
},
{
"db": "NVD",
"id": "CVE-2006-0946"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in Thomson SpeedTouch modems running firmware 5.3.2.6.0 allows remote attackers to inject arbitrary web script or HTML via the name parameter to the LocalNetwork page. The SpeedTouch 500 series are prone to a cross-site scripting vulnerability. This issue is due to a failure in the devices to properly sanitize user-supplied input. \nAn attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the compromise of the device",
"sources": [
{
"db": "NVD",
"id": "CVE-2006-0946"
},
{
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "VULHUB",
"id": "VHN-17054"
}
],
"trust": 1.8
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-17054",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-17054"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "BID",
"id": "16839",
"trust": 2.6
},
{
"db": "NVD",
"id": "CVE-2006-0946",
"trust": 2.3
},
{
"db": "SECUNIA",
"id": "19069",
"trust": 1.7
},
{
"db": "VUPEN",
"id": "ADV-2006-0765",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1015688",
"trust": 1.7
},
{
"db": "OSVDB",
"id": "23527",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200602-430",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2006-1160",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20060226 THOMSON SPEEDTOUCH 500 MODEMS VULNERABLE TO XSS",
"trust": 0.6
},
{
"db": "XF",
"id": "24977",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "27320",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-80933",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-17054",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"db": "VULHUB",
"id": "VHN-17054"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "NVD",
"id": "CVE-2006-0946"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
]
},
"id": "VAR-200603-0482",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"db": "VULHUB",
"id": "VHN-17054"
}
],
"trust": 1.676190457142857
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1160"
}
]
},
"last_update_date": "2023-12-18T13:25:57.352000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2006-0946"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://www.securityfocus.com/bid/16839"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/archive/1/426186"
},
{
"trust": 1.7,
"url": "http://www.osvdb.org/23527"
},
{
"trust": 1.7,
"url": "http://securitytracker.com/id?1015688"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/19069"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2006/0765"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/24977"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/24977"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2006/0765"
},
{
"trust": 0.3,
"url": "http://www.speedtouchdsl.com/homeprod_dsl.htm"
},
{
"trust": 0.3,
"url": "/archive/1/426186"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"db": "VULHUB",
"id": "VHN-17054"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "NVD",
"id": "CVE-2006-0946"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"db": "VULHUB",
"id": "VHN-17054"
},
{
"db": "BID",
"id": "16839"
},
{
"db": "NVD",
"id": "CVE-2006-0946"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-02-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"date": "2006-03-01T00:00:00",
"db": "VULHUB",
"id": "VHN-17054"
},
{
"date": "2006-02-25T00:00:00",
"db": "BID",
"id": "16839"
},
{
"date": "2006-03-01T02:02:00",
"db": "NVD",
"id": "CVE-2006-0946"
},
{
"date": "2006-02-28T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2006-02-28T00:00:00",
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"date": "2017-07-20T00:00:00",
"db": "VULHUB",
"id": "VHN-17054"
},
{
"date": "2006-03-01T05:16:00",
"db": "BID",
"id": "16839"
},
{
"date": "2017-07-20T01:30:11.880000",
"db": "NVD",
"id": "CVE-2006-0946"
},
{
"date": "2006-03-01T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson SpeedTouch Cross-Site Scripting Vulnerability",
"sources": [
{
"db": "CNVD",
"id": "CNVD-2006-1160"
},
{
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
],
"trust": 1.2
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200602-430"
}
],
"trust": 0.6
}
}
VAR-200709-0415
Vulnerability from variot - Updated: 2023-12-18 12:32The Thomson ST 2030 SIP phone with software 1.52.1 allows remote attackers to cause a denial of service (device hang) via (1) an empty SIP message or (2) a SIP INVITE message with a malformed To header, different vectors than CVE-2007-4553. This vulnerability CVE-2007-4553 Is a different vulnerability.Denial of service by a third party via the following message ( Device hang ) There is a possibility of being put into a state.
BETA test the new Secunia Personal Software Inspector!
The Secunia PSI detects installed software on your computer and categorises it as either Insecure, End-of-Life, or Up-To-Date. Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors.
Download the free PSI BETA from the Secunia website: https://psi.secunia.com/
TITLE: Thomson SpeedTouch 2030 Denial of Service Vulnerability
SECUNIA ADVISORY ID: SA26587
VERIFY ADVISORY: http://secunia.com/advisories/26587/
CRITICAL: Moderately critical
IMPACT: DoS
WHERE:
From remote
OPERATING SYSTEM: Thomson SpeedTouch 2030 VoIP Phone http://secunia.com/product/15497/
DESCRIPTION: A vulnerability has been reported in the Thomson SpeedTouch 2030 VoIP phone, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is caused due to an unspecified error in the handling of INVITE messages and can be exploited to crash the device by sending a specially crafted INVITE message containing a "/" character after the version in the "Via:" field.
The vulnerability is reported in software version 1.52.1. Other versions may also be affected.
SOLUTION: Use the device in a trusted network environment only.
PROVIDED AND/OR DISCOVERED BY: Humberto J. Abdelnur, Radu State, and Olivier Festor
ORIGINAL ADVISORY: http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065433.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200709-0415",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "st 2030 sip phone",
"scope": "eq",
"trust": 2.4,
"vendor": "thomson",
"version": "1.52.1"
},
{
"model": "st sip phone",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "20301.52.1"
}
],
"sources": [
{
"db": "BID",
"id": "85415"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006071"
},
{
"db": "NVD",
"id": "CVE-2007-4753"
},
{
"db": "CNNVD",
"id": "CNNVD-200709-069"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:thomson:st_2030_sip_phone:1.52.1:firmware:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-4753"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Unknown",
"sources": [
{
"db": "BID",
"id": "85415"
}
],
"trust": 0.3
},
"cve": "CVE-2007-4753",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2007-4753",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-28115",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-4753",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200709-069",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-28115",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28115"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006071"
},
{
"db": "NVD",
"id": "CVE-2007-4753"
},
{
"db": "CNNVD",
"id": "CNNVD-200709-069"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Thomson ST 2030 SIP phone with software 1.52.1 allows remote attackers to cause a denial of service (device hang) via (1) an empty SIP message or (2) a SIP INVITE message with a malformed To header, different vectors than CVE-2007-4553. This vulnerability CVE-2007-4553 Is a different vulnerability.Denial of service by a third party via the following message ( Device hang ) There is a possibility of being put into a state. \n\n----------------------------------------------------------------------\n\nBETA test the new Secunia Personal Software Inspector!\n\nThe Secunia PSI detects installed software on your computer and\ncategorises it as either Insecure, End-of-Life, or Up-To-Date. \nEffectively enabling you to focus your attention on software\ninstallations where more secure versions are available from the\nvendors. \n\nDownload the free PSI BETA from the Secunia website:\nhttps://psi.secunia.com/\n\n----------------------------------------------------------------------\n\nTITLE:\nThomson SpeedTouch 2030 Denial of Service Vulnerability\n\nSECUNIA ADVISORY ID:\nSA26587\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/26587/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nDoS\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nThomson SpeedTouch 2030 VoIP Phone\nhttp://secunia.com/product/15497/\n\nDESCRIPTION:\nA vulnerability has been reported in the Thomson SpeedTouch 2030 VoIP\nphone, which can be exploited by malicious people to cause a DoS\n(Denial of Service). \n\nThe vulnerability is caused due to an unspecified error in the\nhandling of INVITE messages and can be exploited to crash the device\nby sending a specially crafted INVITE message containing a \"/\"\ncharacter after the version in the \"Via:\" field. \n\nThe vulnerability is reported in software version 1.52.1. Other\nversions may also be affected. \n\nSOLUTION:\nUse the device in a trusted network environment only. \n\nPROVIDED AND/OR DISCOVERED BY:\nHumberto J. Abdelnur, Radu State, and Olivier Festor\n\nORIGINAL ADVISORY:\nhttp://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065433.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-4753"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006071"
},
{
"db": "BID",
"id": "85415"
},
{
"db": "VULHUB",
"id": "VHN-28115"
},
{
"db": "PACKETSTORM",
"id": "58859"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-4753",
"trust": 2.8
},
{
"db": "SECTRACK",
"id": "1018616",
"trust": 2.0
},
{
"db": "SECTRACK",
"id": "1018611",
"trust": 2.0
},
{
"db": "SREASON",
"id": "3104",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "26587",
"trust": 1.8
},
{
"db": "XF",
"id": "36286",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006071",
"trust": 0.8
},
{
"db": "FULLDISC",
"id": "20070828 DOS VULNERABILITY ON THOMSON SIP PHONE ST 2030 USING AN EMPTY PACKET",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20070827 DOS VULNERABILITY ON THOMSON SIP PHONE ST 2030 USING THE TO HEADER",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200709-069",
"trust": 0.6
},
{
"db": "BID",
"id": "85415",
"trust": 0.4
},
{
"db": "VULHUB",
"id": "VHN-28115",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "58859",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28115"
},
{
"db": "BID",
"id": "85415"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006071"
},
{
"db": "PACKETSTORM",
"id": "58859"
},
{
"db": "NVD",
"id": "CVE-2007-4753"
},
{
"db": "CNNVD",
"id": "CNNVD-200709-069"
}
]
},
"id": "VAR-200709-0415",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-28115"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:32:13.880000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://thomsonreuters.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-006071"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
},
{
"problemtype": "CWE-DesignError",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-006071"
},
{
"db": "NVD",
"id": "CVE-2007-4753"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-august/065458.html"
},
{
"trust": 2.0,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-august/065478.html"
},
{
"trust": 2.0,
"url": "http://securitytracker.com/id?1018611"
},
{
"trust": 2.0,
"url": "http://securitytracker.com/id?1018616"
},
{
"trust": 2.0,
"url": "http://securityreason.com/securityalert/3104"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/26587"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36286"
},
{
"trust": 0.9,
"url": "http://xforce.iss.net/xforce/xfdb/36286"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-4753"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-4753"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/26587/"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.1,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-august/065433.html"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/15497/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28115"
},
{
"db": "BID",
"id": "85415"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006071"
},
{
"db": "PACKETSTORM",
"id": "58859"
},
{
"db": "NVD",
"id": "CVE-2007-4753"
},
{
"db": "CNNVD",
"id": "CNNVD-200709-069"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-28115"
},
{
"db": "BID",
"id": "85415"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006071"
},
{
"db": "PACKETSTORM",
"id": "58859"
},
{
"db": "NVD",
"id": "CVE-2007-4753"
},
{
"db": "CNNVD",
"id": "CNNVD-200709-069"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-09-08T00:00:00",
"db": "VULHUB",
"id": "VHN-28115"
},
{
"date": "2007-09-07T00:00:00",
"db": "BID",
"id": "85415"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-006071"
},
{
"date": "2007-08-27T15:28:28",
"db": "PACKETSTORM",
"id": "58859"
},
{
"date": "2007-09-08T00:17:00",
"db": "NVD",
"id": "CVE-2007-4753"
},
{
"date": "2007-09-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200709-069"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-29T00:00:00",
"db": "VULHUB",
"id": "VHN-28115"
},
{
"date": "2007-09-07T00:00:00",
"db": "BID",
"id": "85415"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-006071"
},
{
"date": "2017-07-29T01:33:10.910000",
"db": "NVD",
"id": "CVE-2007-4753"
},
{
"date": "2007-09-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200709-069"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200709-069"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson ST 2030 SIP Service disruption on telephones (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-006071"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "unknown",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200709-069"
}
],
"trust": 0.6
}
}
VAR-200708-0441
Vulnerability from variot - Updated: 2023-12-18 12:32The Thomson ST 2030 SIP phone with software 1.52.1 allows remote attackers to cause a denial of service (device hang) via an INVITE message with a Via header that contains a '/' (slash) instead of the required space following the SIP version number. Thomson SpeedTouch 2030 is prone to a denial-of-service vulnerability because the device fails to handle specially crafted SIP INVITE messages. Exploiting this issue allows remote attackers to cause the device to stop responding, thus denying service to legitimate users. This issue affects Thomas SpeedTouch 2030 firmware 1.52.1; other versions may also be affected.
BETA test the new Secunia Personal Software Inspector!
The Secunia PSI detects installed software on your computer and categorises it as either Insecure, End-of-Life, or Up-To-Date. Effectively enabling you to focus your attention on software installations where more secure versions are available from the vendors.
Download the free PSI BETA from the Secunia website: https://psi.secunia.com/
TITLE: Thomson SpeedTouch 2030 Denial of Service Vulnerability
SECUNIA ADVISORY ID: SA26587
VERIFY ADVISORY: http://secunia.com/advisories/26587/
CRITICAL: Moderately critical
IMPACT: DoS
WHERE:
From remote
OPERATING SYSTEM: Thomson SpeedTouch 2030 VoIP Phone http://secunia.com/product/15497/
DESCRIPTION: A vulnerability has been reported in the Thomson SpeedTouch 2030 VoIP phone, which can be exploited by malicious people to cause a DoS (Denial of Service).
The vulnerability is reported in software version 1.52.1.
SOLUTION: Use the device in a trusted network environment only.
PROVIDED AND/OR DISCOVERED BY: Humberto J. Abdelnur, Radu State, and Olivier Festor
ORIGINAL ADVISORY: http://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065433.html
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200708-0441",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "st 2030 sip phone",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "1"
},
{
"model": "st 2030 sip phone",
"scope": "eq",
"trust": 0.8,
"vendor": "thomson",
"version": "1.52.1"
},
{
"model": "speedtouch",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "20301.52.1"
}
],
"sources": [
{
"db": "BID",
"id": "25446"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006035"
},
{
"db": "NVD",
"id": "CVE-2007-4553"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-419"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:thomson:st_2030_sip_phone:1:1.52.1_firmware:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-4553"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Humberto J. Abdelnur, Radu State, and Olivier Festor are credited with the discovery of this vulnerability.",
"sources": [
{
"db": "BID",
"id": "25446"
}
],
"trust": 0.3
},
"cve": "CVE-2007-4553",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 5.0,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2007-4553",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"exploitabilityScore": 10.0,
"id": "VHN-27915",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:N/I:N/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-4553",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200708-419",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-27915",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27915"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006035"
},
{
"db": "NVD",
"id": "CVE-2007-4553"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-419"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Thomson ST 2030 SIP phone with software 1.52.1 allows remote attackers to cause a denial of service (device hang) via an INVITE message with a Via header that contains a \u0027/\u0027 (slash) instead of the required space following the SIP version number. Thomson SpeedTouch 2030 is prone to a denial-of-service vulnerability because the device fails to handle specially crafted SIP INVITE messages. \nExploiting this issue allows remote attackers to cause the device to stop responding, thus denying service to legitimate users. \nThis issue affects Thomas SpeedTouch 2030 firmware 1.52.1; other versions may also be affected. \n\n----------------------------------------------------------------------\n\nBETA test the new Secunia Personal Software Inspector!\n\nThe Secunia PSI detects installed software on your computer and\ncategorises it as either Insecure, End-of-Life, or Up-To-Date. \nEffectively enabling you to focus your attention on software\ninstallations where more secure versions are available from the\nvendors. \n\nDownload the free PSI BETA from the Secunia website:\nhttps://psi.secunia.com/\n\n----------------------------------------------------------------------\n\nTITLE:\nThomson SpeedTouch 2030 Denial of Service Vulnerability\n\nSECUNIA ADVISORY ID:\nSA26587\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/26587/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nDoS\n\nWHERE:\n\u003eFrom remote\n\nOPERATING SYSTEM:\nThomson SpeedTouch 2030 VoIP Phone\nhttp://secunia.com/product/15497/\n\nDESCRIPTION:\nA vulnerability has been reported in the Thomson SpeedTouch 2030 VoIP\nphone, which can be exploited by malicious people to cause a DoS\n(Denial of Service). \n\nThe vulnerability is reported in software version 1.52.1. \n\nSOLUTION:\nUse the device in a trusted network environment only. \n\nPROVIDED AND/OR DISCOVERED BY:\nHumberto J. Abdelnur, Radu State, and Olivier Festor\n\nORIGINAL ADVISORY:\nhttp://lists.grok.org.uk/pipermail/full-disclosure/2007-August/065433.html\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-4553"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006035"
},
{
"db": "BID",
"id": "25446"
},
{
"db": "VULHUB",
"id": "VHN-27915"
},
{
"db": "PACKETSTORM",
"id": "58859"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-27915",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27915"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-4553",
"trust": 2.8
},
{
"db": "BID",
"id": "25446",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "26587",
"trust": 1.8
},
{
"db": "VUPEN",
"id": "ADV-2007-2988",
"trust": 1.7
},
{
"db": "SECTRACK",
"id": "1018603",
"trust": 1.7
},
{
"db": "SREASON",
"id": "3075",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006035",
"trust": 0.8
},
{
"db": "XF",
"id": "36217",
"trust": 0.6
},
{
"db": "FULLDISC",
"id": "20070823 DOS VULNERABILITY ON THOMSON SIP PHONE ST 2030 USING THE VIA HEADER",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200708-419",
"trust": 0.6
},
{
"db": "EXPLOIT-DB",
"id": "30530",
"trust": 0.1
},
{
"db": "EXPLOIT-DB",
"id": "4319",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-83912",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-27915",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "58859",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27915"
},
{
"db": "BID",
"id": "25446"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006035"
},
{
"db": "PACKETSTORM",
"id": "58859"
},
{
"db": "NVD",
"id": "CVE-2007-4553"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-419"
}
]
},
"id": "VAR-200708-0441",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-27915"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T12:32:13.847000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://thomsonreuters.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-006035"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-4553"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.8,
"url": "http://lists.grok.org.uk/pipermail/full-disclosure/2007-august/065433.html"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/25446"
},
{
"trust": 1.7,
"url": "http://www.securitytracker.com/id?1018603"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/26587"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/3075"
},
{
"trust": 1.1,
"url": "http://www.vupen.com/english/advisories/2007/2988"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36217"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-4553"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-4553"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/36217"
},
{
"trust": 0.6,
"url": "http://www.frsirt.com/english/advisories/2007/2988"
},
{
"trust": 0.3,
"url": "http://www.thomsontelecompartner.com/en/products/viewabusinesssolution.php?id=87"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/26587/"
},
{
"trust": 0.1,
"url": "https://psi.secunia.com/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/15497/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-27915"
},
{
"db": "BID",
"id": "25446"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006035"
},
{
"db": "PACKETSTORM",
"id": "58859"
},
{
"db": "NVD",
"id": "CVE-2007-4553"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-419"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-27915"
},
{
"db": "BID",
"id": "25446"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006035"
},
{
"db": "PACKETSTORM",
"id": "58859"
},
{
"db": "NVD",
"id": "CVE-2007-4553"
},
{
"db": "CNNVD",
"id": "CNNVD-200708-419"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-08-28T00:00:00",
"db": "VULHUB",
"id": "VHN-27915"
},
{
"date": "2007-08-27T00:00:00",
"db": "BID",
"id": "25446"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-006035"
},
{
"date": "2007-08-27T15:28:28",
"db": "PACKETSTORM",
"id": "58859"
},
{
"date": "2007-08-28T00:17:00",
"db": "NVD",
"id": "CVE-2007-4553"
},
{
"date": "2007-08-27T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200708-419"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-29T00:00:00",
"db": "VULHUB",
"id": "VHN-27915"
},
{
"date": "2015-05-07T17:35:00",
"db": "BID",
"id": "25446"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-006035"
},
{
"date": "2017-07-29T01:33:00.660000",
"db": "NVD",
"id": "CVE-2007-4553"
},
{
"date": "2007-10-29T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200708-419"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200708-419"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson ST 2030 SIP Service disruption on telephones (DoS) Vulnerabilities",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-006035"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "unknown",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200708-419"
}
],
"trust": 0.6
}
}
VAR-201111-0179
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen on the WAN port, which allows remote attackers to administer the firewall via SOAP requests. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0179",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linksys wrt54gx router",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.00.05"
},
{
"model": "wrt54gx",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "2.0"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "linksys wrt54gx router",
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": "wrt54gx",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "firmware 2.00.05"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54gx_router_firmware:2.00.05:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gx:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4500"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4500",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4500",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52445",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4500",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-362",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52445",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen on the WAN port, which allows remote attackers to administer the firewall via SOAP requests. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4500",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5055",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52445",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"id": "VAR-201111-0179",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "VULHUB",
"id": "VHN-52445"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5055"
}
]
},
"last_update_date": "2023-12-18T12:09:30.385000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.cisco.com/"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5055)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6024"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.8,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4500"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4500"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"db": "VULHUB",
"id": "VHN-52445"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52445"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:04.793000",
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5055"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52445"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003030"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-22T11:55:04.793000",
"db": "NVD",
"id": "CVE-2011-4500"
},
{
"date": "2011-11-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-362"
}
],
"trust": 0.6
}
}
VAR-201111-0160
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in the Pseudo ICS UPnP software on the ZyXEL P-330W allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. ZyXEL P-330W is a wireless broadband router. A vulnerability exists in the UPnP IGD installation enablement of the ZyXEL P-330W's Pseudo ICS UPnP software. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0160",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "pseudoics",
"scope": "eq",
"trust": 1.6,
"vendor": "genmei mori",
"version": "0.1"
},
{
"model": "pseudoics",
"scope": "eq",
"trust": 1.6,
"vendor": "genmei mori",
"version": "0.3"
},
{
"model": "pseudoics",
"scope": "eq",
"trust": 1.6,
"vendor": "genmei mori",
"version": "0.2"
},
{
"model": "p-330w router",
"scope": "eq",
"trust": 1.0,
"vendor": "zyxel",
"version": "*"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "pseudo ics upnp",
"scope": null,
"trust": 0.8,
"vendor": "genmei mori",
"version": null
},
{
"model": "p-330w",
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:genmei_mori:pseudoics:0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:genmei_mori:pseudoics:0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:genmei_mori:pseudoics:0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:zyxel:p-330w_router:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4504"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4504",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4504",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52449",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4504",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-366",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52449",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in the Pseudo ICS UPnP software on the ZyXEL P-330W allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. ZyXEL P-330W is a wireless broadband router. A vulnerability exists in the UPnP IGD installation enablement of the ZyXEL P-330W\u0027s Pseudo ICS UPnP software. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4504",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5060",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52449",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"id": "VAR-201111-0160",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "VULHUB",
"id": "VHN-52449"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5060"
}
]
},
"last_update_date": "2023-12-18T12:09:30.333000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.zyxel.com/"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5060)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6020"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 1.7,
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.1,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4504"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu357851/"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4504"
},
{
"trust": 0.8,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"db": "VULHUB",
"id": "VHN-52449"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52449"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:06.013000",
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5060"
},
{
"date": "2012-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-52449"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003034"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2012-03-08T05:00:00",
"db": "NVD",
"id": "CVE-2011-4504"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-366"
}
],
"trust": 0.6
}
}
VAR-201111-0162
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation on the Thomson (aka Technicolor) TG585 with firmware 7.x before 7.4.3.2 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. A vulnerability exists in the UPnP IGD installation enablement in Thomson (also known as Technicolor) TG585 with firmware 7.x prior to firmware 7.4.3.2. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0162",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "tg585 router",
"scope": "lte",
"trust": 1.0,
"vendor": "technicolor",
"version": "7.4"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 1.0,
"vendor": "technicolor",
"version": "*"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "tg585",
"scope": "lt",
"trust": 0.8,
"vendor": "technicolor",
"version": "7.x"
},
{
"model": "tg585",
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": "tg585",
"scope": "eq",
"trust": 0.8,
"vendor": "technicolor",
"version": "7.4.3.2"
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.6,
"vendor": "technicolor",
"version": "7.4"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:technicolor:tg585_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "7.4",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:technicolor:tg585_router:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4506"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4506",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4506",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52451",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4506",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-368",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52451",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation on the Thomson (aka Technicolor) TG585 with firmware 7.x before 7.4.3.2 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. A vulnerability exists in the UPnP IGD installation enablement in Thomson (also known as Technicolor) TG585 with firmware 7.x prior to firmware 7.4.3.2. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4506",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5064",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52451",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"id": "VAR-201111-0162",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "VULHUB",
"id": "VHN-52451"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5064"
}
]
},
"last_update_date": "2023-12-18T12:09:30.242000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.technicolorbroadbandpartner.com/index.php"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5064)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6022"
},
{
"title": "thomson-download",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=41851"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.5,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 1.1,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4506"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4506"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"db": "VULHUB",
"id": "VHN-52451"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52451"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:06.137000",
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5064"
},
{
"date": "2012-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-52451"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003036"
},
{
"date": "2012-03-08T05:00:00",
"db": "NVD",
"id": "CVE-2011-4506"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-368"
}
],
"trust": 0.6
}
}
VAR-201111-0178
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. A vulnerability exists in the UPnP IGD installation and enablement of multiple versions of the Broadcom UPnP stack on the Cisco Linksys WRT54G. This vulnerability is related to the "external forwarding" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0178",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linksys wrt54gs router",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "2.09.1"
},
{
"model": "linksys wrt54g router",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "3.03.9"
},
{
"model": "linksys wrt54g router",
"scope": "eq",
"trust": 1.6,
"vendor": "cisco",
"version": "4.20.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "2.2"
},
{
"model": "wrt54gs",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "1.0"
},
{
"model": "wrt54gs",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "3.0"
},
{
"model": "linksys wrt54gs router",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "1.06"
},
{
"model": "wrt54gs",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "4.0"
},
{
"model": "wrt54gs",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "2.0"
},
{
"model": "linksys wrt54gs router",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "4.70.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 1.0,
"vendor": "linksys",
"version": "*"
},
{
"model": "linksys wrt54g router",
"scope": "lte",
"trust": 1.0,
"vendor": "cisco",
"version": "4.20.8"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "linksys wrt54g router",
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": "linksys wrt54gs router",
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": "wrt54g",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "firmware 4.30.5"
},
{
"model": "wrt54gs",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "v1 from v3 firmware 4.71.1"
},
{
"model": "wrt54gs",
"scope": "lt",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "v4 firmware 1.06.1"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "linksys wrt54gs router",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "4.70.6"
},
{
"model": "linksys wrt54g router",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "4.20.8"
},
{
"model": "linksys wrt54gs router",
"scope": "eq",
"trust": 0.6,
"vendor": "cisco",
"version": "1.06"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54g_router_firmware:3.03.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54g_router_firmware:4.20.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54g_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.20.8",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54g:2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54g:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54gs_router_firmware:2.09.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54gs_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "4.70.6",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gs:1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gs:2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gs:3.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:cisco:linksys_wrt54gs_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "1.06",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:linksys:wrt54gs:4.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4499"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4499",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4499",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52444",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4499",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-361",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52444",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. A vulnerability exists in the UPnP IGD installation and enablement of multiple versions of the Broadcom UPnP stack on the Cisco Linksys WRT54G. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4499",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-5053",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52444",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"id": "VAR-201111-0178",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "VULHUB",
"id": "VHN-52444"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5053"
}
]
},
"last_update_date": "2023-12-18T12:09:30.055000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.cisco.com/"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5053)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6023"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.8,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4499"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4499"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"db": "VULHUB",
"id": "VHN-52444"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52444"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:04.683000",
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5053"
},
{
"date": "2012-03-09T00:00:00",
"db": "VULHUB",
"id": "VHN-52444"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003029"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2012-03-09T05:00:00",
"db": "NVD",
"id": "CVE-2011-4499"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-361"
}
],
"trust": 0.6
}
}
VAR-201111-0180
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. Vulnerabilities exist in the UPnP IGD installation and enablement of Edimax EdiLinux for various versions of Edimax. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0180",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lb000021 router",
"scope": "eq",
"trust": 2.4,
"vendor": "sweex",
"version": "3.15"
},
{
"model": "6114wg router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "2.08"
},
{
"model": "br-6104k router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "3.21"
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": null
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": null
},
{
"model": "wl-153 router",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": "1.31"
},
{
"model": "wl-153 router",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": "1.34"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": null
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": null
},
{
"model": "6114wg",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": null
},
{
"model": "lb000021",
"scope": "eq",
"trust": 1.0,
"vendor": "sweex",
"version": null
},
{
"model": "cn-wf514 router",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "6114wg router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "1.83"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.9,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "cn-wf512",
"scope": null,
"trust": 0.8,
"vendor": "canyon",
"version": null
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 0.8,
"vendor": "canyon",
"version": "1.83"
},
{
"model": "cn-wf514",
"scope": null,
"trust": 0.8,
"vendor": "canyon",
"version": null
},
{
"model": "cn-wf514 router",
"scope": "eq",
"trust": 0.8,
"vendor": "canyon",
"version": "2.08"
},
{
"model": "br-6104k",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "br-6104k router",
"scope": "lt",
"trust": 0.8,
"vendor": "edimax",
"version": "3.25"
},
{
"model": "br-6114wg",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "br-6114wg router",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "wl-153",
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": "wl-153 router",
"scope": "lt",
"trust": 0.8,
"vendor": "sitecom",
"version": "1.39"
},
{
"model": "lb000021",
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:edimax:br-6104k_router_firmware:3.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:edimax:br-6104k:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canyon-tech:cn-wf512_router_firmware:1.83:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canyon-tech:cn-wf514_router_firmware:2.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:canyon-tech:cn-wf514:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:canyon-tech:cn-wf512:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:edimax:6114wg_router_firmware:1.83:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:edimax:6114wg_router_firmware:2.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:edimax:6114wg:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:1.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:1.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sitecom:wl-153:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sweex:lb000021_router_firmware:3.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sweex:lb000021:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4501"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4501",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4501",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-52446",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4501",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-363",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-52446",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. Vulnerabilities exist in the UPnP IGD installation and enablement of Edimax EdiLinux for various versions of Edimax. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4501",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5058",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52446",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"id": "VAR-201111-0180",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "VULHUB",
"id": "VHN-52446"
}
],
"trust": 1.3453724428571427
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5058"
}
]
},
"last_update_date": "2023-12-18T12:09:29.878000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.canyon-tech.com/"
},
{
"title": "BR-6104K",
"trust": 0.8,
"url": "http://www.edimax.com/en/produce_detail.php?pd_id=58\u0026pl1_id=3\u0026pl2_id=18"
},
{
"title": "BR-6114Wg",
"trust": 0.8,
"url": "http://www.edimax.co.uk/en/produce_detail.php?pd_id=146\u0026pl1_id=1\u0026pl2_id=48"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.sitecom.com/"
},
{
"title": "LB000021",
"trust": 0.8,
"url": "http://www.sweex.com/en/assortiment/internet-networking/routers/lb000021/"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5058)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6019"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.8,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 1.7,
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4501"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4501"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"db": "VULHUB",
"id": "VHN-52446"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52446"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:04.887000",
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5058"
},
{
"date": "2013-01-24T00:00:00",
"db": "VULHUB",
"id": "VHN-52446"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003031"
},
{
"date": "2013-01-24T05:00:00",
"db": "NVD",
"id": "CVE-2011-4501"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-363"
}
],
"trust": 0.6
}
}
VAR-201111-0161
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation on SpeedTouch 5x6 devices with firmware before 6.2.29 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. Speedtouch is a wireless Internet router for the home. This vulnerability is related to the \"external forwarding\" vulnerability. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0161",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedtouch 5x6 router",
"scope": "lte",
"trust": 1.0,
"vendor": "alcatel",
"version": "6.2"
},
{
"model": "speedtouch 5x6 router",
"scope": "eq",
"trust": 1.0,
"vendor": "alcatel",
"version": "*"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.9,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.9,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.9,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.9,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.9,
"vendor": "sitcom",
"version": "0"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "speedtouch 5x6 router",
"scope": null,
"trust": 0.8,
"vendor": "alcatel lucent",
"version": null
},
{
"model": "speedtouch 5x6 router",
"scope": "lt",
"trust": 0.8,
"vendor": "alcatel lucent",
"version": "6.2.29"
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wrt54g beta/2.0",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "4.04.20.6/4.04.0.7/3.03.3.6/3.03.1.3/2.02.4.4/2.02.02.82.00.8"
},
{
"model": "speedtouch 5x6 router",
"scope": "eq",
"trust": 0.6,
"vendor": "alcatel",
"version": "6.2"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:alcatel:speedtouch_5x6_router_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.2",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:alcatel:speedtouch_5x6_router:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4505"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4505",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4505",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-52450",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4505",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-367",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-52450",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation on SpeedTouch 5x6 devices with firmware before 6.2.29 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. Universal Plug and Play (UPnP) is a network protocol that is mostly used for personal computer device discovery and communication with other devices and the Internet. These requests can be used to connect to the internal host or proxy connection of the NAT firewall. Remote unauthenticated attackers can exploit vulnerabilities to scan internal hosts or communicate via the device proxy Internet. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. Speedtouch is a wireless Internet router for the home. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4505",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5063",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52450",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"id": "VAR-201111-0161",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "VULHUB",
"id": "VHN-52450"
}
],
"trust": 1.4788191
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5063"
}
]
},
"last_update_date": "2023-12-18T12:09:29.730000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.alcatel-lucent.com"
},
{
"title": "Patch for Multiple Routers UPnP WAN Interface Remote Unauthorized Access Vulnerability (CNVD-2011-5063)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6021"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.4,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.5,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 1.1,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4505"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4505"
},
{
"trust": 0.6,
"url": "http://www.kb.cert.org/vuls/id/357851http"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"db": "VULHUB",
"id": "VHN-52450"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52450"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:06.090000",
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5063"
},
{
"date": "2012-03-08T00:00:00",
"db": "VULHUB",
"id": "VHN-52450"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003035"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2012-03-08T05:00:00",
"db": "NVD",
"id": "CVE-2011-4505"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-367"
}
],
"trust": 0.6
}
}
VAR-201111-0159
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. A vulnerability exists in the UPnP IGD installation of Broadcom Linux for Sitecom WL-111. This vulnerability is related to the \"external forwarding\" vulnerability. An attacker can exploit this issue to gain unauthorized access to scan the internal host or proxy internet traffic through an affected device. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0159",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "linux",
"scope": null,
"trust": 2.0,
"vendor": "broadcom",
"version": null
},
{
"model": "linux",
"scope": "eq",
"trust": 1.0,
"vendor": "broadcom",
"version": "*"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "wl-111",
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.3,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.3,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.3,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.3,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.3,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.3,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:broadcom:broadcom_linux:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sitecom:wl-111:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4503"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4503",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4503",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4503",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-365",
"trust": 0.6,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in Broadcom Linux on the Sitecom WL-111 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. A vulnerability exists in the UPnP IGD installation of Broadcom Linux for Sitecom WL-111. This vulnerability is related to the \\\"external forwarding\\\" vulnerability. \nAn attacker can exploit this issue to gain unauthorized access to scan the internal host or proxy internet traffic through an affected device. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.77
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.7
},
{
"db": "NVD",
"id": "CVE-2011-4503",
"trust": 3.3
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2011-5043",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"id": "VAR-201111-0159",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5043"
}
],
"trust": 1.361728088888889
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5043"
}
]
},
"last_update_date": "2023-12-18T12:09:29.415000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.broadcom.com/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.sitecom.com/"
},
{
"title": "Patch for Sitecom WL-111 configuration vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6004"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-16",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 4.9,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 1.6,
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"trust": 1.1,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4503"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4503"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:05.967000",
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5043"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003033"
},
{
"date": "2013-01-24T05:00:00",
"db": "NVD",
"id": "CVE-2011-4503"
},
{
"date": "2011-11-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "configuration error",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-365"
}
],
"trust": 0.6
}
}
VAR-201111-0158
Vulnerability from variot - Updated: 2023-12-18 12:09The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. There are vulnerabilities in the Edimax Edimax EdiLinux UPnP IGD installation enablement. An attacker can exploit this issue to gain unauthorized access to scan the internal host or proxy internet traffic through an affected device. The following devices are affected: Cisco Linksys WRT54G firmware version prior to 4.30.5 Cisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1 Cisco Linksys WRT54GS v4 firmware versions prior to 1.06.1 Cisco Linksys WRT54GX firmware 2.00.05 Edimax BR-6104K prior to 3.25 Edimax 6114Wg Canyon-Tech CN-WF512 firmware version 1.83 Canyon-Tech CN-WF514 firmware version 2.08 Sitecom WL-153 prior to firmware 1.39 Sitecom WL-111 Sweex LB000021 firmware version 3.15 ZyXEL P-330W SpeedTouch 5x6 firmware versions prior to 6.2.29 Thomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------
The final version of the CSI 6.0 has been released. Find out why this is not just another Patch Management solution: http://secunia.com/blog/325/
TITLE: Siemens OZW / OZS Multiple Products libupnp Buffer Overflow Vulnerabilities
SECUNIA ADVISORY ID: SA52035
VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/52035/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
RELEASE DATE: 2013-01-31
DISCUSS ADVISORY: http://secunia.com/advisories/52035/#comments
AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s)
http://secunia.com/advisories/52035/
ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS
https://ca.secunia.com/?page=viewadvisory&vuln_id=52035
ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING
http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/
DESCRIPTION: Multiple vulnerabilities have been reported in multiple Siemens OZW and OZS products, which can be exploited by malicious people to compromise a vulnerable device.
1) Multiple vulnerabilities are caused due to a bundled version of libupnp.
For more information: SA51949
2) Multiple boundary errors within the "unique_service_name()" function (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests can be exploited to cause stack-based buffer overflows. The vendor is planning to provide fixes with upcoming firmware updates.
PROVIDED AND/OR DISCOVERED BY: 2) Rapid7
ORIGINAL ADVISORY: Siemens SSA-963338: http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf
Rapid7: https://community.rapid7.com/docs/DOC-2150 https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play
OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
DEEP LINKS: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
EXPLOIT: Further details available in Customer Area: http://secunia.com/vulnerability_intelligence/
About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/advisories/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
. This library is used in several vendor network devices in addition to media streaming and file sharing applications. These vulnerabilities were disclosed on January 29th, 2013 in a CERT Vulnerability Note, VU#922681, which can be viewed at:
http://www.kb.cert.org/vuls/id/922681
Cisco is currently evaluating products for possible exposure to these vulnerabilities. This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.11 (GNU/Linux)
iF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+ ga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5 =6sTu -----END PGP SIGNATURE-----
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201111-0158",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "lb000021 router",
"scope": "eq",
"trust": 3.0,
"vendor": "sweex",
"version": "3.15"
},
{
"model": "br-6104k",
"scope": null,
"trust": 1.4,
"vendor": "edimax",
"version": null
},
{
"model": "wl-153",
"scope": null,
"trust": 1.4,
"vendor": "sitecom",
"version": null
},
{
"model": "6114wg router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "2.08"
},
{
"model": "br-6104k router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "3.21"
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": null
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": null
},
{
"model": "wl-153 router",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": "1.31"
},
{
"model": "wl-153 router",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": "1.34"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 1.0,
"vendor": "sitecom",
"version": null
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": null
},
{
"model": "6114wg",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": null
},
{
"model": "lb000021",
"scope": "eq",
"trust": 1.0,
"vendor": "sweex",
"version": null
},
{
"model": "cn-wf514 router",
"scope": "eq",
"trust": 1.0,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "6114wg router",
"scope": "eq",
"trust": 1.0,
"vendor": "edimax",
"version": "1.83"
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "canyon tech",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "edimax computer",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys a division of cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sitecom",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "technicolor",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "zyxel",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "axis",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "cisco",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "d link",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "fujitsu",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "huawei",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "linksys",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "nec",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "siemens",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "sony",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "synology",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.8,
"vendor": "ipitomy",
"version": null
},
{
"model": "",
"scope": null,
"trust": 0.8,
"vendor": "multiple vendors",
"version": null
},
{
"model": "cn-wf512",
"scope": null,
"trust": 0.8,
"vendor": "canyon",
"version": null
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 0.8,
"vendor": "canyon",
"version": "1.83"
},
{
"model": "cn-wf514",
"scope": null,
"trust": 0.8,
"vendor": "canyon",
"version": null
},
{
"model": "cn-wf514 router",
"scope": "eq",
"trust": 0.8,
"vendor": "canyon",
"version": "2.08"
},
{
"model": "br-6104k router",
"scope": "lt",
"trust": 0.8,
"vendor": "edimax",
"version": "3.25"
},
{
"model": "br-6114wg",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "br-6114wg router",
"scope": null,
"trust": 0.8,
"vendor": "edimax",
"version": null
},
{
"model": "wl-153 router",
"scope": "lt",
"trust": 0.8,
"vendor": "sitecom",
"version": "1.39"
},
{
"model": "lb000021",
"scope": null,
"trust": 0.8,
"vendor": "sweex",
"version": null
},
{
"model": "br-6104k router",
"scope": "eq",
"trust": 0.6,
"vendor": "edimax",
"version": "3.21/2.08/1.83"
},
{
"model": "6114wg",
"scope": null,
"trust": 0.6,
"vendor": "edimax",
"version": null
},
{
"model": "cn-wf512 router",
"scope": "eq",
"trust": 0.6,
"vendor": "canyon tech",
"version": "2.08/1.83"
},
{
"model": "cn-wf514",
"scope": null,
"trust": 0.6,
"vendor": "canyon tech",
"version": null
},
{
"model": "cn-wf512",
"scope": null,
"trust": 0.6,
"vendor": "canyon tech",
"version": null
},
{
"model": "wl-153 router /1.34 router",
"scope": "eq",
"trust": 0.6,
"vendor": "sitecom",
"version": "1.31"
},
{
"model": "p-330w",
"scope": "eq",
"trust": 0.3,
"vendor": "zyxel",
"version": "0"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "0"
},
{
"model": null,
"scope": "eq",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x60"
},
{
"model": "wl-153",
"scope": "eq",
"trust": 0.3,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wl-111",
"scope": "eq",
"trust": 0.3,
"vendor": "sitcom",
"version": "0"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.20.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.04.0.7"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.3.6"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v3.03.1.3"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.4.4"
},
{
"model": "wrt54g beta",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.02.8"
},
{
"model": "wrt54g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.02.00.8"
},
{
"model": "br-6104k",
"scope": "eq",
"trust": 0.3,
"vendor": "edimax",
"version": "0"
},
{
"model": "6114wg",
"scope": "eq",
"trust": 0.3,
"vendor": "edimax",
"version": "0"
},
{
"model": "cn-wf514",
"scope": "eq",
"trust": 0.3,
"vendor": "canyon tech",
"version": "2.08"
},
{
"model": "cn-wf512",
"scope": "eq",
"trust": 0.3,
"vendor": "canyon tech",
"version": "1.83"
},
{
"model": "tg585 router",
"scope": "ne",
"trust": 0.3,
"vendor": "thomson",
"version": "7.4.3.2"
},
{
"model": null,
"scope": "ne",
"trust": 0.3,
"vendor": "speedtouch",
"version": "5x66.2.29"
},
{
"model": "wl-153",
"scope": "ne",
"trust": 0.3,
"vendor": "sitcom",
"version": "1.39"
},
{
"model": "wrt54g",
"scope": "ne",
"trust": 0.3,
"vendor": "linksys",
"version": "v4.01.0.6"
},
{
"model": "br-6104k",
"scope": "ne",
"trust": 0.3,
"vendor": "edimax",
"version": "3.25"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:edimax:br-6104k_router_firmware:3.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:edimax:br-6104k:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:canyon-tech:cn-wf512_router_firmware:1.83:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:canyon-tech:cn-wf514_router_firmware:2.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:canyon-tech:cn-wf514:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:canyon-tech:cn-wf512:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:edimax:6114wg_router_firmware:1.83:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:edimax:6114wg_router_firmware:2.08:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:edimax:6114wg:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:1.31:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:sitecom:wl-153_router_firmware:1.34:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sitecom:wl-153:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:sweex:lb000021_router_firmware:3.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:sweex:lb000021:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4502"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Daniel Garcia",
"sources": [
{
"db": "BID",
"id": "50810"
}
],
"trust": 0.3
},
"cve": "CVE-2011-4502",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "CARNEGIE MELLON",
"availabilityImpact": "COMPLETE",
"availabilityRequirement": "NOT DEFINED",
"baseScore": 9.4,
"collateralDamagePotential": "NOT DEFINED",
"confidentialityImpact": "NONE",
"confidentialityRequirement": "NOT DEFINED",
"enviromentalScore": 8.0,
"exploitability": "PROOF-OF-CONCEPT",
"exploitabilityScore": 10.0,
"id": "VU#357851",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"integrityRequirement": "NOT DEFINED",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"remediationLevel": "WORKAROUND",
"reportConfidence": "CONFIRMED",
"severity": "HIGH",
"targetDistribution": "NOT DEFINED",
"trust": 0.8,
"userInterationRequired": null,
"vector_string": "AV:N/AC:L/Au:N/C:N/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 7.5,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2011-4502",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-52447",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2011-4502",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CARNEGIE MELLON",
"id": "VU#357851",
"trust": 0.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-201111-364",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-52447",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters. The Portable SDK for UPnP Devices libupnp library contains multiple buffer overflow vulnerabilities. Devices that use libupnp may also accept UPnP queries over the WAN interface, therefore exposing the vulnerabilities to the internet. Universal Plug and Play (UPnP) Multiple compatible routers have vulnerabilities with insufficient access restrictions. UPnP For supported routers, WAN Unintended from the side interface UPnP There is a vulnerability that allows the request to be accepted.An unauthenticated remote third party could obtain local network information or use the product as a proxy. There are vulnerabilities in the Edimax Edimax EdiLinux UPnP IGD installation enablement. \nAn attacker can exploit this issue to gain unauthorized access to scan the internal host or proxy internet traffic through an affected device. \nThe following devices are affected:\nCisco Linksys WRT54G firmware version prior to 4.30.5\nCisco Linksys WRT54GS v1 through v3 firmware versions prior to 4.71.1\nCisco Linksys WRT54GS v4 firmware versions prior to 1.06.1\nCisco Linksys WRT54GX firmware 2.00.05\nEdimax BR-6104K prior to 3.25\nEdimax 6114Wg\nCanyon-Tech CN-WF512 firmware version 1.83\nCanyon-Tech CN-WF514 firmware version 2.08\nSitecom WL-153 prior to firmware 1.39\nSitecom WL-111\nSweex LB000021 firmware version 3.15\nZyXEL P-330W\nSpeedTouch 5x6 firmware versions prior to 6.2.29\nThomson TG585 firmware versions prior to 7.4.3.2. ----------------------------------------------------------------------\n\nThe final version of the CSI 6.0 has been released. \nFind out why this is not just another Patch Management solution: http://secunia.com/blog/325/\n\n----------------------------------------------------------------------\n\nTITLE:\nSiemens OZW / OZS Multiple Products libupnp Buffer Overflow\nVulnerabilities\n\nSECUNIA ADVISORY ID:\nSA52035\n\nVERIFY ADVISORY:\nSecunia.com\nhttp://secunia.com/advisories/52035/\nCustomer Area (Credentials Required)\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nRELEASE DATE:\n2013-01-31\n\nDISCUSS ADVISORY:\nhttp://secunia.com/advisories/52035/#comments\n\nAVAILABLE ON SITE AND IN CUSTOMER AREA:\n * Last Update\n * Popularity\n * Comments\n * Criticality Level\n * Impact\n * Where\n * Solution Status\n * Operating System / Software\n * CVE Reference(s)\n\nhttp://secunia.com/advisories/52035/\n\nONLY AVAILABLE IN CUSTOMER AREA:\n * Authentication Level\n * Report Reliability\n * Secunia PoC\n * Secunia Analysis\n * Systems Affected\n * Approve Distribution\n * Remediation Status\n * Secunia CVSS Score\n * CVSS\n\nhttps://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035\n\nONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI:\n * AUTOMATED SCANNING\n\nhttp://secunia.com/vulnerability_scanning/personal/\nhttp://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/\n\nDESCRIPTION:\nMultiple vulnerabilities have been reported in multiple Siemens OZW\nand OZS products, which can be exploited by malicious people to\ncompromise a vulnerable device. \n\n1) Multiple vulnerabilities are caused due to a bundled version of\nlibupnp. \n\nFor more information:\nSA51949\n\n2) Multiple boundary errors within the \"unique_service_name()\"\nfunction (ssdp/ssdp_ctrlpt.c) in libupnp when handling SSDP requests\ncan be exploited to cause stack-based buffer overflows. The vendor is planning\nto provide fixes with upcoming firmware updates. \n\nPROVIDED AND/OR DISCOVERED BY:\n2) Rapid7\n\nORIGINAL ADVISORY:\nSiemens SSA-963338:\nhttp://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf\n\nRapid7:\nhttps://community.rapid7.com/docs/DOC-2150\nhttps://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play\n\nOTHER REFERENCES:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nDEEP LINKS:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED DESCRIPTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXTENDED SOLUTION:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\nEXPLOIT:\nFurther details available in Customer Area:\nhttp://secunia.com/vulnerability_intelligence/\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\nprivate users keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/advisories/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/advisories/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n. This library is used in several vendor network\ndevices in addition to media streaming and file sharing applications. \nThese vulnerabilities were disclosed on January 29th, 2013 in a CERT\nVulnerability Note, VU#922681, which can be viewed at:\n\nhttp://www.kb.cert.org/vuls/id/922681\n\nCisco is currently evaluating products for possible exposure to these\nvulnerabilities. This advisory is available at the following link:\n\nhttp://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20130129-upnp\n\n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1.4.11 (GNU/Linux)\n\niF4EAREIAAYFAlEIJZ8ACgkQUddfH3/BbTrUagD9FnKSVkc2iIfGs+7c8SVPT26+\nga5hYEz9UMUnitcqnbcBAIKe6KnkR6he2zbstVtbTKtqSjE7pfVb3lTKVZSeAkM5\n=6sTu\n-----END PGP SIGNATURE-----\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
}
],
"trust": 4.86
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851",
"trust": 5.8
},
{
"db": "NVD",
"id": "CVE-2011-4502",
"trust": 3.4
},
{
"db": "SIEMENS",
"id": "SSA-963338",
"trust": 0.9
},
{
"db": "CERT/CC",
"id": "VU#922681",
"trust": 0.9
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364",
"trust": 0.7
},
{
"db": "CNVD",
"id": "CNVD-2011-5045",
"trust": 0.6
},
{
"db": "NSFOCUS",
"id": "18224",
"trust": 0.6
},
{
"db": "BID",
"id": "50810",
"trust": 0.3
},
{
"db": "SECUNIA",
"id": "52035",
"trust": 0.2
},
{
"db": "VULHUB",
"id": "VHN-52447",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119949",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "119896",
"trust": 0.1
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"id": "VAR-201111-0158",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "VULHUB",
"id": "VHN-52447"
}
],
"trust": 1.3453724428571427
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5045"
}
]
},
"last_update_date": "2023-12-18T12:09:29.362000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.canyon-tech.com/"
},
{
"title": "BR-6104K",
"trust": 0.8,
"url": "http://www.edimax.com/en/produce_detail.php?pd_id=58\u0026pl1_id=3\u0026pl2_id=18"
},
{
"title": "BR-6114Wg",
"trust": 0.8,
"url": "http://www.edimax.co.uk/en/produce_detail.php?pd_id=146\u0026pl1_id=1\u0026pl2_id=48"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.sitecom.com/"
},
{
"title": "LB000021",
"trust": 0.8,
"url": "http://www.sweex.com/en/assortiment/internet-networking/routers/lb000021/"
},
{
"title": "Patch for Edimax \u0027Edimax EdiLinux\u0027 configuration vulnerability",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/6005"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-78",
"trust": 1.1
},
{
"problemtype": "CWE-16",
"trust": 0.8
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 5.0,
"url": "http://www.kb.cert.org/vuls/id/357851"
},
{
"trust": 2.8,
"url": "http://www.upnp-hacks.org/devices.html"
},
{
"trust": 1.7,
"url": "http://www.upnp-hacks.org/suspect.html"
},
{
"trust": 1.6,
"url": "http://homekb.cisco.com/cisco2/ukp.aspx?vw=1\u0026articleid=28341"
},
{
"trust": 1.6,
"url": "http://jvn.jp/cert/jvnvu357851"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/community/infosec/blog/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play"
},
{
"trust": 0.9,
"url": "https://community.rapid7.com/docs/doc-2150"
},
{
"trust": 0.9,
"url": "http://www.siemens.com/corporate-technology/pool/de/forschungsfelder/siemens_security_advisory_ssa-963338.pdf"
},
{
"trust": 0.8,
"url": "http://toor.do/upnp.html"
},
{
"trust": 0.8,
"url": "http://www.h-online.com/security/news/item/upnp-enabled-routers-allow-attacks-on-lans-1329727.html"
},
{
"trust": 0.8,
"url": "http://toor.do/defcon-19-garcia-upnp-mapping-wp.pdf"
},
{
"trust": 0.8,
"url": "http://pupnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "https://community.rapid7.com/servlet/jiveservlet/download/2150-1-16596/securityflawsupnp.pdf"
},
{
"trust": 0.8,
"url": "http://www.rapid7.com/resources/free-security-software-downloads/universal-plug-and-play-jan-2013.jsp"
},
{
"trust": 0.8,
"url": "http://opentools.homeip.net/dev-tools-for-upnp"
},
{
"trust": 0.8,
"url": "http://upnp.sourceforge.net/"
},
{
"trust": 0.8,
"url": "http://www.dlink.com/us/en/technology/upnp"
},
{
"trust": 0.8,
"url": "http://jpn.nec.com/security-info/secinfo/nv13-003.html"
},
{
"trust": 0.8,
"url": "http://www.ipitomy.com/index.php/mi-security-notice-ip001"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2011-4502"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2011-4502"
},
{
"trust": 0.6,
"url": "http://www.nsfocus.net/vulndb/18224"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/#comments"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_intelligence/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/about_secunia_advisories/"
},
{
"trust": 0.1,
"url": "https://ca.secunia.com/?page=viewadvisory\u0026vuln_id=52035"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/52035/"
},
{
"trust": 0.1,
"url": "http://secunia.com/vulnerability_scanning/personal/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/blog/325/"
},
{
"trust": 0.1,
"url": "http://tools.cisco.com/security/center/content/ciscosecurityadvisory/cisco-sa-20130129-upnp"
},
{
"trust": 0.1,
"url": "http://www.kb.cert.org/vuls/id/922681"
}
],
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CERT/CC",
"id": "VU#357851"
},
{
"db": "CERT/CC",
"id": "VU#922681"
},
{
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"db": "VULHUB",
"id": "VHN-52447"
},
{
"db": "BID",
"id": "50810"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"db": "PACKETSTORM",
"id": "119949"
},
{
"db": "PACKETSTORM",
"id": "119896"
},
{
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2011-10-05T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2013-01-29T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"date": "2011-11-22T00:00:00",
"db": "VULHUB",
"id": "VHN-52447"
},
{
"date": "2011-11-24T00:00:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"date": "2013-01-31T07:26:31",
"db": "PACKETSTORM",
"id": "119949"
},
{
"date": "2013-01-30T02:46:44",
"db": "PACKETSTORM",
"id": "119896"
},
{
"date": "2011-11-22T11:55:05.043000",
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"date": "2011-11-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2012-11-30T00:00:00",
"db": "CERT/CC",
"id": "VU#357851"
},
{
"date": "2014-07-30T00:00:00",
"db": "CERT/CC",
"id": "VU#922681"
},
{
"date": "2011-11-24T00:00:00",
"db": "CNVD",
"id": "CNVD-2011-5045"
},
{
"date": "2013-01-24T00:00:00",
"db": "VULHUB",
"id": "VHN-52447"
},
{
"date": "2015-03-19T08:33:00",
"db": "BID",
"id": "50810"
},
{
"date": "2011-10-12T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-002341"
},
{
"date": "2011-11-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2011-003032"
},
{
"date": "2013-01-24T05:00:00",
"db": "NVD",
"id": "CVE-2011-4502"
},
{
"date": "2011-11-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "UPnP requests accepted over router WAN interfaces",
"sources": [
{
"db": "CERT/CC",
"id": "VU#357851"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "operating system commend injection",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201111-364"
}
],
"trust": 0.6
}
}
VAR-200710-0018
Vulnerability from variot - Updated: 2023-12-18 11:39The Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allows remote attackers on an intranet to bypass authentication and gain administrative access via vectors including a '/' (slash) character at the end of the PATH_INFO to cgi/b, aka "double-slash auth bypass." NOTE: remote attackers outside the intranet can exploit this by leveraging a separate CSRF vulnerability. NOTE: SpeedTouch 780 might also be affected by some of these issues. BT Home Hub and Speedtouch 7G are both home wireless Internet routers.
Multiple security vulnerabilities exist in BT Home Hub and SpeedTouch 7G routers, allowing malicious users to perform cross-site footsteps, cross-site request spoofing, script injection attacks, or bypass certain security restrictions.
1) Input validation errors when processing URLs may allow attackers to access and change password-protected resources, such as configuration and settings pages, through specially crafted URLs containing two slashes.
2) Failure to perform proper filtering before recording the login user name may allow the injection of arbitrary HTML and script code. If the user browses the log, it will be executed in the user's browser session.
3) As the input to the name parameter is not properly filtered, arbitrary HTML and script code may be executed in the user's browser session.
4) Failure to properly filter the input of url parameters in the cgi / b / ic / connect / file may result in the execution of arbitrary HTML and script code in the user's browser session.
5) The device does not perform validity checks on user requests, allowing users to perform certain operations through HTTP requests. If the logged-in administrator visits a malicious site, this may cause the administrator password to be changed.
6) Users can directly access certain pages, such as the Wireless Security page, through the URL without authentication.
7) The administrative user can save the backup or load the configuration file through the URL, and these files should only be accessed by the tech account. Successful exploits of many of these issues will allow an attacker to completely compromise the affected device. NOTE: '/' (slash) vectors are covered by CVE-2007-5383
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200710-0018",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "home hub",
"scope": "lte",
"trust": 1.8,
"vendor": "bt",
"version": "6.2.6.b"
},
{
"model": "speedtouch 7g router",
"scope": "eq",
"trust": 1.0,
"vendor": "alcatel",
"version": "*"
},
{
"model": "speedtouch 7g router",
"scope": null,
"trust": 0.8,
"vendor": "alcatel lucent",
"version": null
},
{
"model": null,
"scope": null,
"trust": 0.6,
"vendor": "none",
"version": null
},
{
"model": "speedtouch 7g router",
"scope": null,
"trust": 0.6,
"vendor": "alcatel",
"version": null
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "0"
},
{
"model": "home hub .b",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "6.2.6"
},
{
"model": "home hub",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "6.2.2.6"
},
{
"model": "home hub",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "0"
},
{
"model": "speedtouch 7g",
"scope": null,
"trust": 0.3,
"vendor": "alcatel",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-5927"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002762"
},
{
"db": "NVD",
"id": "CVE-2007-5383"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:alcatel:speedtouch_7g_router:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:bt:home_hub:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "6.2.6.b",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-5383"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adrian Pastor\u203b m123303@richmond.ac.uk",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
],
"trust": 0.6
},
"cve": "CVE-2007-5383",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": true,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 10.0,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2007-5383",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 10.0,
"id": "VHN-28745",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:C/I:C/A:C",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-5383",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200710-197",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "VULHUB",
"id": "VHN-28745",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28745"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002762"
},
{
"db": "NVD",
"id": "CVE-2007-5383"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allows remote attackers on an intranet to bypass authentication and gain administrative access via vectors including a \u0027/\u0027 (slash) character at the end of the PATH_INFO to cgi/b, aka \"double-slash auth bypass.\" NOTE: remote attackers outside the intranet can exploit this by leveraging a separate CSRF vulnerability. NOTE: SpeedTouch 780 might also be affected by some of these issues. BT Home Hub and Speedtouch 7G are both home wireless Internet routers. \n\n\u00a0Multiple security vulnerabilities exist in BT Home Hub and SpeedTouch 7G routers, allowing malicious users to perform cross-site footsteps, cross-site request spoofing, script injection attacks, or bypass certain security restrictions. \n\n\u00a01) Input validation errors when processing URLs may allow attackers to access and change password-protected resources, such as configuration and settings pages, through specially crafted URLs containing two slashes. \n\n\u00a02) Failure to perform proper filtering before recording the login user name may allow the injection of arbitrary HTML and script code. If the user browses the log, it will be executed in the user\u0027s browser session. \n\n\u00a03) As the input to the name parameter is not properly filtered, arbitrary HTML and script code may be executed in the user\u0027s browser session. \n\n\u00a04) Failure to properly filter the input of url parameters in the cgi / b / ic / connect / file may result in the execution of arbitrary HTML and script code in the user\u0027s browser session. \n\n\u00a05) The device does not perform validity checks on user requests, allowing users to perform certain operations through HTTP requests. If the logged-in administrator visits a malicious site, this may cause the administrator password to be changed. \n\n\u00a06) Users can directly access certain pages, such as the Wireless Security page, through the URL without authentication. \n\n\u00a07) The administrative user can save the backup or load the configuration file through the URL, and these files should only be accessed by the tech account. \nSuccessful exploits of many of these issues will allow an attacker to completely compromise the affected device. NOTE: \u0027/\u0027 (slash) vectors are covered by CVE-2007-5383",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-5383"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002762"
},
{
"db": "CNVD",
"id": "CNVD-2007-5927"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "VULHUB",
"id": "VHN-28745"
}
],
"trust": 2.52
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-5383",
"trust": 3.4
},
{
"db": "BID",
"id": "25972",
"trust": 2.0
},
{
"db": "SREASON",
"id": "3213",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002762",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2007-5927",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20080301 THE ROUTER HACKING CHALLENGE IS OVER!",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20071008 BT HOME FLUB: PWNIN THE BT HOME HUB",
"trust": 0.6
},
{
"db": "XF",
"id": "41271",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200710-197",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-28745",
"trust": 0.1
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2007-5927"
},
{
"db": "VULHUB",
"id": "VHN-28745"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002762"
},
{
"db": "NVD",
"id": "CVE-2007-5383"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
]
},
"id": "VAR-200710-0018",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-28745"
}
],
"trust": 0.975
},
"last_update_date": "2023-12-18T11:39:48.732000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.alcatel-lucent.com/alcatel/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.bt.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002762"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-287",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28745"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002762"
},
{
"db": "NVD",
"id": "CVE-2007-5383"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub"
},
{
"trust": 2.0,
"url": "http://www.theregister.co.uk/2007/10/09/bt_home_hub_vuln/"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/25972"
},
{
"trust": 1.7,
"url": "http://www.gnucitizen.org/blog/holes-in-embedded-devices-authentication-bypass-pt-1/"
},
{
"trust": 1.7,
"url": "http://www.gnucitizen.org/projects/router-hacking-challenge/"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/3213"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/481835/100/0/threaded"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/489009/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41271"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-5383"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-5383"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/41271"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/489009/100/0/threaded"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/481835/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://www.homehub.bt.com/"
},
{
"trust": 0.3,
"url": "http://www.gnucitizen.org/blog/call-jacking"
},
{
"trust": 0.3,
"url": "http://www.thomson.net/en/home/minisites/bap/telecom/subcategory.html?category=dsl%20modems"
},
{
"trust": 0.3,
"url": "/archive/1/481835"
},
{
"trust": 0.3,
"url": "/archive/1/486081"
},
{
"trust": 0.3,
"url": "/archive/1/517314"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28745"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002762"
},
{
"db": "NVD",
"id": "CVE-2007-5383"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2007-5927"
},
{
"db": "VULHUB",
"id": "VHN-28745"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002762"
},
{
"db": "NVD",
"id": "CVE-2007-5383"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-10-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-5927"
},
{
"date": "2007-10-12T00:00:00",
"db": "VULHUB",
"id": "VHN-28745"
},
{
"date": "2007-10-08T00:00:00",
"db": "BID",
"id": "25972"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002762"
},
{
"date": "2007-10-12T01:17:00",
"db": "NVD",
"id": "CVE-2007-5383"
},
{
"date": "2007-10-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-10-08T00:00:00",
"db": "CNVD",
"id": "CNVD-2007-5927"
},
{
"date": "2018-10-15T00:00:00",
"db": "VULHUB",
"id": "VHN-28745"
},
{
"date": "2011-04-04T20:05:00",
"db": "BID",
"id": "25972"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002762"
},
{
"date": "2018-10-15T21:44:13.623000",
"db": "NVD",
"id": "CVE-2007-5383"
},
{
"date": "2007-10-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "BT Home Hub Used in Thomson/Alcatel SpeedTouch 7G Vulnerability to gain administrator access on router",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002762"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-197"
}
],
"trust": 0.6
}
}
VAR-200408-0052
Vulnerability from variot - Updated: 2023-12-18 11:11Thomson SpeedTouch 510 ADSL Router with firmware GV8BAA3.270, and possibly earlier versions, generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections. The ability to predict TCP sequence numbers may allow a remote attacker to inject packets into a vulnerable data stream, for example the telnet service on the affected modem. Remote attackers can use this vulnerability to carry out TCP communication forgery attacks. The TCP initialization sequence number of the device can be guessed, which can cause the attacker to fail the ADSL Modem communication by forging the communication, or hijack the device. BACKGROUND
The Thompson (formerly Alcatel) SpeedTouch is an ADSL router for home and business providing a continuously available, "always on," connection. More information about the product can be found at http://www.speedtouchdsl.com/.
II.
The problem specifically exists due to the predictable nature of the TCP Initial Sequence Number (ISN) generator on the device. The following sanitized tcpdump output demonstrates the existence of the vulnerability when 10 consecutive TCP connection requests are generated for the telnet server (port 23) on the Thompson device:
48.3 host_a.1096 > host_b.telnet: S 48.3 host_b.telnet > host_a.1096: S 4081040897:4081040897(0) ack 48.3 host_a.1096 > host_b.telnet: R 48.4 host_a.1096 > host_b.telnet: S 48.4 host_b.telnet > host_a.1096: S 4081104897:4081104897(0) ack 48.4 host_a.1096 > host_b.telnet: R 48.6 host_a.1096 > host_b.telnet: S 48.6 host_b.telnet > host_a.1096: S 4081232897:4081232897(0) ack 48.6 host_a.1096 > host_b.telnet: R 48.7 host_a.1096 > host_b.telnet: S 48.7 host_b.telnet > host_a.1096: S 4081296897:4081296897(0) ack 48.7 host_a.1096 > host_b.telnet: R 48.9 host_a.1096 > host_b.telnet: S 48.9 host_b.telnet > host_a.1096: S 4081360897:4081360897(0) ack 48.9 host_a.1096 > host_b.telnet: R 49.0 host_a.1096 > host_b.telnet: S 49.0 host_b.telnet > host_a.1096: S 4081488897:4081488897(0) ack 49.0 host_a.1096 > host_b.telnet: R 49.2 host_a.1096 > host_b.telnet: S 49.2 host_b.telnet > host_a.1096: S 4081552897:4081552897(0) ack 49.2 host_a.1096 > host_b.telnet: R 49.3 host_a.1096 > host_b.telnet: S 49.3 host_b.telnet > host_a.1096: S 4081616897:4081616897(0) ack 49.3 host_a.1096 > host_b.telnet: R 49.5 host_a.1096 > host_b.telnet: S 49.5 host_b.telnet > host_a.1096: S 4081744897:4081744897(0) ack 49.5 host_a.1096 > host_b.telnet: R 49.6 host_a.1096 > host_b.telnet: S 49.6 host_b.telnet > host_a.1096: S 4081808897:4081808897(0) ack 49.6 host_a.1096 > host_b.telnet: R
In the above example, host_a is the querying host and host_b is the Thompson device. A clear pattern in ISN generation can be seen as the value increases by approximately 64,000 each millisecond.
III. ANALYSIS
Successful exploitation of weak ISNs for the purpose of connection spoofing is not a trivial task. Successful exploitation allows an attacker to generate traffic on behalf of the affected device. Such an ability is most dangerous when trust paths exist between the affected device and another remote system.
IV. DETECTION
iDEFENSE has verified the existence of this vulnerability in Thompson's SpeedTouch firmware version GV8BAA3.270 (1003825). It is suspected that earlier versions are susceptible to exploitation as well.
V. WORKAROUNDS
Untrusted traffic should be filtered at the network perimeter.
VI. CVE INFORMATION
The Common Vulnerabilities and Exposures (CVE) project has assigned the name CAN-2004-0641 to this issue. This is a candidate for inclusion in the CVE list (http://cve.mitre.org), which standardizes names for security problems.
VII. DISCLOSURE TIMELINE
06/08/04 Initial vendor contact - no response 06/08/04 iDEFENSE clients notified 06/18/04 Secondary vendor contact - no response 08/05/04 Public disclosure
VIII. CREDIT
The discoverer wishes to remain anonymous.
Get paid for vulnerability research http://www.idefense.com/poi/teams/vcp.jsp
IX. LEGAL NOTICES
Copyright © 2004 iDEFENSE, Inc.
Permission is granted for the redistribution of this alert electronically. It may not be edited in any way without the express written consent of iDEFENSE. If you wish to reprint the whole or any part of this alert in any other medium other than electronically, please email customerservice@idefense.com for permission.
Disclaimer: The information in the advisory is believed to be accurate at the time of publishing based on currently available information. Use of the information constitutes acceptance for use in an AS IS condition. There are no warranties with regard to this information. Neither the author nor the publisher accepts any liability for any direct, indirect, or consequential loss or damage arising from use of, or reliance on, this information
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200408-0052",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedtouch",
"scope": "eq",
"trust": 1.6,
"vendor": "thomson",
"version": "510_adsl_router"
},
{
"model": "speedtouch adsl router",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "510"
}
],
"sources": [
{
"db": "BID",
"id": "10881"
},
{
"db": "NVD",
"id": "CVE-2004-0641"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:510_adsl_router:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0641"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "iDEFENSE",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
],
"trust": 0.6
},
"cve": "CVE-2004-0641",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-9071",
"impactScore": 6.4,
"integrityImpact": "PARTIAL",
"severity": "HIGH",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:P/A:P",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2004-0641",
"trust": 1.0,
"value": "HIGH"
},
{
"author": "CNNVD",
"id": "CNNVD-200408-015",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "VULHUB",
"id": "VHN-9071",
"trust": 0.1,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-9071"
},
{
"db": "NVD",
"id": "CVE-2004-0641"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson SpeedTouch 510 ADSL Router with firmware GV8BAA3.270, and possibly earlier versions, generates predictable TCP Initial Sequence Numbers (ISNs), which allows remote attackers to spoof or hijack TCP connections. The ability to predict TCP sequence numbers may allow a remote attacker to inject packets into a vulnerable data stream, for example the telnet service on the affected modem. Remote attackers can use this vulnerability to carry out TCP communication forgery attacks. The TCP initialization sequence number of the device can be guessed, which can cause the attacker to fail the ADSL Modem communication by forging the communication, or hijack the device. BACKGROUND\n\nThe Thompson (formerly Alcatel) SpeedTouch is an ADSL router for home\nand business providing a continuously available, \"always on,\"\nconnection. More information about the product can be found at\nhttp://www.speedtouchdsl.com/. \n\nII. \n\nThe problem specifically exists due to the predictable nature of the TCP\nInitial Sequence Number (ISN) generator on the device. The following\nsanitized tcpdump output demonstrates the existence of the vulnerability\nwhen 10 consecutive TCP connection requests are generated for the telnet\nserver (port 23) on the Thompson device:\n\n48.3 host_a.1096 \u003e host_b.telnet: S\n48.3 host_b.telnet \u003e host_a.1096: S 4081040897:4081040897(0) ack\n48.3 host_a.1096 \u003e host_b.telnet: R\n48.4 host_a.1096 \u003e host_b.telnet: S\n48.4 host_b.telnet \u003e host_a.1096: S 4081104897:4081104897(0) ack\n48.4 host_a.1096 \u003e host_b.telnet: R\n48.6 host_a.1096 \u003e host_b.telnet: S\n48.6 host_b.telnet \u003e host_a.1096: S 4081232897:4081232897(0) ack\n48.6 host_a.1096 \u003e host_b.telnet: R\n48.7 host_a.1096 \u003e host_b.telnet: S\n48.7 host_b.telnet \u003e host_a.1096: S 4081296897:4081296897(0) ack\n48.7 host_a.1096 \u003e host_b.telnet: R\n48.9 host_a.1096 \u003e host_b.telnet: S\n48.9 host_b.telnet \u003e host_a.1096: S 4081360897:4081360897(0) ack\n48.9 host_a.1096 \u003e host_b.telnet: R\n49.0 host_a.1096 \u003e host_b.telnet: S\n49.0 host_b.telnet \u003e host_a.1096: S 4081488897:4081488897(0) ack\n49.0 host_a.1096 \u003e host_b.telnet: R\n49.2 host_a.1096 \u003e host_b.telnet: S\n49.2 host_b.telnet \u003e host_a.1096: S 4081552897:4081552897(0) ack\n49.2 host_a.1096 \u003e host_b.telnet: R\n49.3 host_a.1096 \u003e host_b.telnet: S\n49.3 host_b.telnet \u003e host_a.1096: S 4081616897:4081616897(0) ack\n49.3 host_a.1096 \u003e host_b.telnet: R\n49.5 host_a.1096 \u003e host_b.telnet: S\n49.5 host_b.telnet \u003e host_a.1096: S 4081744897:4081744897(0) ack\n49.5 host_a.1096 \u003e host_b.telnet: R\n49.6 host_a.1096 \u003e host_b.telnet: S\n49.6 host_b.telnet \u003e host_a.1096: S 4081808897:4081808897(0) ack\n49.6 host_a.1096 \u003e host_b.telnet: R\n\nIn the above example, host_a is the querying host and host_b is the\nThompson device. A clear pattern in ISN generation can be seen as the\nvalue increases by approximately 64,000 each millisecond. \n\nIII. ANALYSIS\n\nSuccessful exploitation of weak ISNs for the purpose of connection\nspoofing is not a trivial task. Successful exploitation allows an\nattacker to generate traffic on behalf of the affected device. Such an\nability is most dangerous when trust paths exist between the affected\ndevice and another remote system. \n\nIV. DETECTION\n\niDEFENSE has verified the existence of this vulnerability in Thompson\u0027s\nSpeedTouch firmware version GV8BAA3.270 (1003825). It is suspected that\nearlier versions are susceptible to exploitation as well. \n\nV. WORKAROUNDS\n\nUntrusted traffic should be filtered at the network perimeter. \n\nVI. CVE INFORMATION\n\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\nname CAN-2004-0641 to this issue. This is a candidate for inclusion in\nthe CVE list (http://cve.mitre.org), which standardizes names for\nsecurity problems. \n\nVII. DISCLOSURE TIMELINE\n\n06/08/04 Initial vendor contact - no response\n06/08/04 iDEFENSE clients notified\n06/18/04 Secondary vendor contact - no response\n08/05/04 Public disclosure\n\nVIII. CREDIT\n\nThe discoverer wishes to remain anonymous. \n\nGet paid for vulnerability research\nhttp://www.idefense.com/poi/teams/vcp.jsp\n\nIX. LEGAL NOTICES\n\nCopyright \u00a9 2004 iDEFENSE, Inc. \n\nPermission is granted for the redistribution of this alert\nelectronically. It may not be edited in any way without the express\nwritten consent of iDEFENSE. If you wish to reprint the whole or any\npart of this alert in any other medium other than electronically, please\nemail customerservice@idefense.com for permission. \n\nDisclaimer: The information in the advisory is believed to be accurate\nat the time of publishing based on currently available information. Use\nof the information constitutes acceptance for use in an AS IS condition. \nThere are no warranties with regard to this information. Neither the\nauthor nor the publisher accepts any liability for any direct, indirect,\nor consequential loss or damage arising from use of, or reliance on,\nthis information",
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0641"
},
{
"db": "BID",
"id": "10881"
},
{
"db": "VULHUB",
"id": "VHN-9071"
},
{
"db": "PACKETSTORM",
"id": "33975"
}
],
"trust": 1.35
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-9071",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-9071"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2004-0641",
"trust": 2.1
},
{
"db": "BID",
"id": "10881",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "12238",
"trust": 1.7
},
{
"db": "AUSCERT",
"id": "ESB-2004.0504",
"trust": 1.7
},
{
"db": "CNNVD",
"id": "CNNVD-200408-015",
"trust": 0.7
},
{
"db": "IDEFENSE",
"id": "20040805 THOMPSON SPEEDTOUCH HOME ADSL MODEM PREDICTABLE TCP ISN GENERATION",
"trust": 0.6
},
{
"db": "XF",
"id": "16919",
"trust": 0.6
},
{
"db": "PACKETSTORM",
"id": "33975",
"trust": 0.2
},
{
"db": "EXPLOIT-DB",
"id": "19522",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-9071",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-9071"
},
{
"db": "BID",
"id": "10881"
},
{
"db": "PACKETSTORM",
"id": "33975"
},
{
"db": "NVD",
"id": "CVE-2004-0641"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
]
},
"id": "VAR-200408-0052",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-9071"
}
],
"trust": 0.01
},
"last_update_date": "2023-12-18T11:11:19.430000Z",
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2004-0641"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.auscert.org.au/render.html?it=4299"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/10881"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/12238/"
},
{
"trust": 1.6,
"url": "http://www.idefense.com/application/poi/display?id=120\u0026type=vulnerabilities\u0026flashstatus=true"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/16919"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/16919"
},
{
"trust": 0.3,
"url": "http://www.idefense.com/application/poi/display?id=120\u0026type=vulnerabilities"
},
{
"trust": 0.3,
"url": "http://www.speedtouch.com/"
},
{
"trust": 0.1,
"url": "http://www.idefense.com/application/poi/display?id=120\u0026amp;type=vulnerabilities\u0026amp;flashstatus=true"
},
{
"trust": 0.1,
"url": "http://cve.mitre.org),"
},
{
"trust": 0.1,
"url": "http://www.idefense.com/poi/teams/vcp.jsp"
},
{
"trust": 0.1,
"url": "http://www.speedtouchdsl.com/."
},
{
"trust": 0.1,
"url": "https://nvd.nist.gov/vuln/detail/cve-2004-0641"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-9071"
},
{
"db": "BID",
"id": "10881"
},
{
"db": "PACKETSTORM",
"id": "33975"
},
{
"db": "NVD",
"id": "CVE-2004-0641"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-9071"
},
{
"db": "BID",
"id": "10881"
},
{
"db": "PACKETSTORM",
"id": "33975"
},
{
"db": "NVD",
"id": "CVE-2004-0641"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2004-08-05T00:00:00",
"db": "VULHUB",
"id": "VHN-9071"
},
{
"date": "2004-08-05T00:00:00",
"db": "BID",
"id": "10881"
},
{
"date": "2004-08-06T18:58:41",
"db": "PACKETSTORM",
"id": "33975"
},
{
"date": "2004-08-05T04:00:00",
"db": "NVD",
"id": "CVE-2004-0641"
},
{
"date": "2004-08-05T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-11T00:00:00",
"db": "VULHUB",
"id": "VHN-9071"
},
{
"date": "2009-07-12T06:16:00",
"db": "BID",
"id": "10881"
},
{
"date": "2017-07-11T01:30:20.197000",
"db": "NVD",
"id": "CVE-2004-0641"
},
{
"date": "2005-10-20T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "PACKETSTORM",
"id": "33975"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
],
"trust": 0.7
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson SpeedTouch Home ADSL Modem predictable TCP Serial number vulnerability",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
],
"trust": 0.6
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "10881"
},
{
"db": "CNNVD",
"id": "CNNVD-200408-015"
}
],
"trust": 0.9
}
}
VAR-200710-0019
Vulnerability from variot - Updated: 2023-12-18 11:01Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session. NOTE: SpeedTouch 780 might also be affected by some of these issues. BT Home Hub and Thomson/Alcatel Speedtouch 7G routers are prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, a cross-site scripting issue, multiple HTML-injection issues, and multiple authentication-bypass issues. Successful exploits of many of these issues will allow an attacker to completely compromise the affected device. These issues affect the BT Home Hub and Thomson/Alcatel Speedtouch 7G routers
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200710-0019",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedtouch 7g router",
"scope": "eq",
"trust": 1.0,
"vendor": "alcatel",
"version": "*"
},
{
"model": "home hub",
"scope": "eq",
"trust": 1.0,
"vendor": "bt",
"version": "*"
},
{
"model": "home hub",
"scope": "lte",
"trust": 0.8,
"vendor": "bt",
"version": "6.2.6.b"
},
{
"model": "speedtouch 7g router",
"scope": null,
"trust": 0.8,
"vendor": "alcatel lucent",
"version": null
},
{
"model": "speedtouch 7g router",
"scope": null,
"trust": 0.6,
"vendor": "alcatel",
"version": null
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "0"
},
{
"model": "home hub .b",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "6.2.6"
},
{
"model": "home hub",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "6.2.2.6"
},
{
"model": "home hub",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "0"
},
{
"model": "speedtouch 7g",
"scope": null,
"trust": 0.3,
"vendor": "alcatel",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002763"
},
{
"db": "NVD",
"id": "CVE-2007-5384"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:alcatel:speedtouch_7g_router:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:bt:home_hub:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-5384"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adrian Pastor\u203b m123303@richmond.ac.uk",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
],
"trust": 0.6
},
"cve": "CVE-2007-5384",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2007-5384",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-28746",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-5384",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200710-214",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-28746",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28746"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002763"
},
{
"db": "NVD",
"id": "CVE-2007-5384"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site request forgery (CSRF) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to perform actions as administrators via unspecified POST requests, as demonstrated by enabling an inbound remote-assistance HTTPS session on TCP port 51003. NOTE: an authentication bypass can be leveraged to exploit this in the absence of an existing administrative session. NOTE: SpeedTouch 780 might also be affected by some of these issues. BT Home Hub and Thomson/Alcatel Speedtouch 7G routers are prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, a cross-site scripting issue, multiple HTML-injection issues, and multiple authentication-bypass issues. \nSuccessful exploits of many of these issues will allow an attacker to completely compromise the affected device. \nThese issues affect the BT Home Hub and Thomson/Alcatel Speedtouch 7G routers",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-5384"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002763"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "VULHUB",
"id": "VHN-28746"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-5384",
"trust": 2.8
},
{
"db": "BID",
"id": "25972",
"trust": 2.0
},
{
"db": "SREASON",
"id": "3213",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002763",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20071008 BT HOME FLUB: PWNIN THE BT HOME HUB",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200710-214",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-28746",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28746"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002763"
},
{
"db": "NVD",
"id": "CVE-2007-5384"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
]
},
"id": "VAR-200710-0019",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-28746"
}
],
"trust": 0.975
},
"last_update_date": "2023-12-18T11:01:57.148000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.alcatel-lucent.com/alcatel/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.bt.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002763"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-352",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28746"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002763"
},
{
"db": "NVD",
"id": "CVE-2007-5384"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub"
},
{
"trust": 2.0,
"url": "http://www.theregister.co.uk/2007/10/09/bt_home_hub_vuln/"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/25972"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/3213"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/481835/100/0/threaded"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-5384"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-5384"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/481835/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://www.homehub.bt.com/"
},
{
"trust": 0.3,
"url": "http://www.gnucitizen.org/blog/call-jacking"
},
{
"trust": 0.3,
"url": "http://www.thomson.net/en/home/minisites/bap/telecom/subcategory.html?category=dsl%20modems"
},
{
"trust": 0.3,
"url": "/archive/1/481835"
},
{
"trust": 0.3,
"url": "/archive/1/486081"
},
{
"trust": 0.3,
"url": "/archive/1/517314"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28746"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002763"
},
{
"db": "NVD",
"id": "CVE-2007-5384"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-28746"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002763"
},
{
"db": "NVD",
"id": "CVE-2007-5384"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-10-12T00:00:00",
"db": "VULHUB",
"id": "VHN-28746"
},
{
"date": "2007-10-08T00:00:00",
"db": "BID",
"id": "25972"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002763"
},
{
"date": "2007-10-12T01:17:00",
"db": "NVD",
"id": "CVE-2007-5384"
},
{
"date": "2007-10-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-15T00:00:00",
"db": "VULHUB",
"id": "VHN-28746"
},
{
"date": "2011-04-04T20:05:00",
"db": "BID",
"id": "25972"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002763"
},
{
"date": "2018-10-15T21:44:14.513000",
"db": "NVD",
"id": "CVE-2007-5384"
},
{
"date": "2007-10-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "BT Home Hub Used in Thomson/Alcatel SpeedTouch 7G Cross-site request forgery vulnerability in router",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002763"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "cross-site request forgery",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-214"
}
],
"trust": 0.6
}
}
VAR-200710-0020
Vulnerability from variot - Updated: 2023-12-18 11:00Multiple cross-site scripting (XSS) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. BT Home Hub Used in etc. Successful exploits of many of these issues will allow an attacker to completely compromise the affected device
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200710-0020",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedtouch 7g router",
"scope": "eq",
"trust": 1.0,
"vendor": "alcatel",
"version": "*"
},
{
"model": "home hub",
"scope": "eq",
"trust": 1.0,
"vendor": "bt",
"version": "*"
},
{
"model": "home hub",
"scope": "lte",
"trust": 0.8,
"vendor": "bt",
"version": "6.2.6.b"
},
{
"model": "speedtouch 7g router",
"scope": null,
"trust": 0.8,
"vendor": "alcatel lucent",
"version": null
},
{
"model": "speedtouch 7g router",
"scope": null,
"trust": 0.6,
"vendor": "alcatel",
"version": null
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "0"
},
{
"model": "home hub .b",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "6.2.6"
},
{
"model": "home hub",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "6.2.2.6"
},
{
"model": "home hub",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "0"
},
{
"model": "speedtouch 7g",
"scope": null,
"trust": 0.3,
"vendor": "alcatel",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002764"
},
{
"db": "NVD",
"id": "CVE-2007-5385"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:bt:home_hub:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:h:alcatel:speedtouch_7g_router:*:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-5385"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adrian Pastor\u203b m123303@richmond.ac.uk",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
],
"trust": 0.6
},
"cve": "CVE-2007-5385",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2007-5385",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-28747",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-5385",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200710-212",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-28747",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28747"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002764"
},
{
"db": "NVD",
"id": "CVE-2007-5385"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Multiple cross-site scripting (XSS) vulnerabilities in the Thomson/Alcatel SpeedTouch 7G router, as used for the BT Home Hub 6.2.6.B and earlier, allow remote attackers to inject arbitrary web script or HTML via unspecified vectors. BT Home Hub Used in etc. \nSuccessful exploits of many of these issues will allow an attacker to completely compromise the affected device",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-5385"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002764"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "VULHUB",
"id": "VHN-28747"
}
],
"trust": 1.98
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-5385",
"trust": 2.8
},
{
"db": "BID",
"id": "25972",
"trust": 2.0
},
{
"db": "SREASON",
"id": "3213",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002764",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20071008 BT HOME FLUB: PWNIN THE BT HOME HUB",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200710-212",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-28747",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28747"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002764"
},
{
"db": "NVD",
"id": "CVE-2007-5385"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
]
},
"id": "VAR-200710-0020",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-28747"
}
],
"trust": 0.975
},
"last_update_date": "2023-12-18T11:00:38.244000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.alcatel-lucent.com/alcatel/"
},
{
"title": "Top Page",
"trust": 0.8,
"url": "http://www.bt.com/"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002764"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28747"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002764"
},
{
"db": "NVD",
"id": "CVE-2007-5385"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.0,
"url": "http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub"
},
{
"trust": 2.0,
"url": "http://www.theregister.co.uk/2007/10/09/bt_home_hub_vuln/"
},
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/25972"
},
{
"trust": 1.7,
"url": "http://securityreason.com/securityalert/3213"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/481835/100/0/threaded"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-5385"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-5385"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/481835/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://www.homehub.bt.com/"
},
{
"trust": 0.3,
"url": "http://www.gnucitizen.org/blog/call-jacking"
},
{
"trust": 0.3,
"url": "http://www.thomson.net/en/home/minisites/bap/telecom/subcategory.html?category=dsl%20modems"
},
{
"trust": 0.3,
"url": "/archive/1/481835"
},
{
"trust": 0.3,
"url": "/archive/1/486081"
},
{
"trust": 0.3,
"url": "/archive/1/517314"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-28747"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002764"
},
{
"db": "NVD",
"id": "CVE-2007-5385"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-28747"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-002764"
},
{
"db": "NVD",
"id": "CVE-2007-5385"
},
{
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-10-12T00:00:00",
"db": "VULHUB",
"id": "VHN-28747"
},
{
"date": "2007-10-08T00:00:00",
"db": "BID",
"id": "25972"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002764"
},
{
"date": "2007-10-12T01:17:00",
"db": "NVD",
"id": "CVE-2007-5385"
},
{
"date": "2007-10-11T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-15T00:00:00",
"db": "VULHUB",
"id": "VHN-28747"
},
{
"date": "2011-04-04T20:05:00",
"db": "BID",
"id": "25972"
},
{
"date": "2012-06-26T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-002764"
},
{
"date": "2018-10-15T21:44:14.937000",
"db": "NVD",
"id": "CVE-2007-5385"
},
{
"date": "2007-10-15T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "BT Home Hub Used in etc. Thomson/Alcatel SpeedTouch 7G Router cross-site scripting vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-002764"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "XSS",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200710-212"
}
],
"trust": 0.6
}
}
VAR-200711-0147
Vulnerability from variot - Updated: 2023-12-18 10:55Cross-site scripting (XSS) vulnerability in cgi/b/ic/connect in the Thomson SpeedTouch 716 with firmware 5.4.0.14 allows remote attackers to inject arbitrary web script or HTML via the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. BT Home Hub and Thomson/Alcatel Speedtouch 7G routers are prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, a cross-site scripting issue, multiple HTML-injection issues, and multiple authentication-bypass issues. Successful exploits of many of these issues will allow an attacker to completely compromise the affected device. These issues affect the BT Home Hub and Thomson/Alcatel Speedtouch 7G routers.
2003: 2,700 advisories published 2004: 3,100 advisories published 2005: 4,600 advisories published 2006: 5,300 advisories published
How do you know which Secunia advisories are important to you?
The Secunia Vulnerability Intelligence Solutions allows you to filter and structure all the information you need, so you can address issues effectively.
Input passed to the "url" parameter in /cgi/b/ic/connect/ is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in a user's browser session in context of an affected site.
The vulnerability is reported in firmware version 5.4.0.14. Other versions may also be affected.
SOLUTION: Do not browse untrusted websites or follow untrusted links.
PROVIDED AND/OR DISCOVERED BY: Remco
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200711-0147",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "speedtouch",
"scope": "eq",
"trust": 2.4,
"vendor": "thomson",
"version": "716"
},
{
"model": "tg585 router",
"scope": "eq",
"trust": 0.3,
"vendor": "thomson",
"version": "0"
},
{
"model": "home hub .b",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "6.2.6"
},
{
"model": "home hub",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "6.2.2.6"
},
{
"model": "home hub",
"scope": "eq",
"trust": 0.3,
"vendor": "bt",
"version": "0"
},
{
"model": "speedtouch 7g",
"scope": null,
"trust": 0.3,
"vendor": "alcatel",
"version": null
}
],
"sources": [
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006334"
},
{
"db": "NVD",
"id": "CVE-2007-6003"
},
{
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:thomson:speedtouch:716:*:firmware_5.4.0.14:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-6003"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Adrian Pastor m123303@richmond.ac.uk",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
],
"trust": 0.6
},
"cve": "CVE-2007-6003",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": true,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Medium",
"accessVector": "Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 4.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2007-6003",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 8.6,
"id": "VHN-29365",
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:M/AU:N/C:N/I:P/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "NVD",
"id": "CVE-2007-6003",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-200711-243",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-29365",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-29365"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006334"
},
{
"db": "NVD",
"id": "CVE-2007-6003"
},
{
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Cross-site scripting (XSS) vulnerability in cgi/b/ic/connect in the Thomson SpeedTouch 716 with firmware 5.4.0.14 allows remote attackers to inject arbitrary web script or HTML via the url parameter. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information. BT Home Hub and Thomson/Alcatel Speedtouch 7G routers are prone to multiple web-interface vulnerabilities, including a cross-site request-forgery issue, a cross-site scripting issue, multiple HTML-injection issues, and multiple authentication-bypass issues. \nSuccessful exploits of many of these issues will allow an attacker to completely compromise the affected device. \nThese issues affect the BT Home Hub and Thomson/Alcatel Speedtouch 7G routers. \n\n----------------------------------------------------------------------\n\n2003: 2,700 advisories published\n2004: 3,100 advisories published\n2005: 4,600 advisories published\n2006: 5,300 advisories published\n\nHow do you know which Secunia advisories are important to you?\n\nThe Secunia Vulnerability Intelligence Solutions allows you to filter\nand structure all the information you need, so you can address issues\neffectively. \n\nInput passed to the \"url\" parameter in /cgi/b/ic/connect/ is not\nproperly sanitised before being returned to the user. This can be\nexploited to execute arbitrary HTML and script code in a user\u0027s\nbrowser session in context of an affected site. \n\nThe vulnerability is reported in firmware version 5.4.0.14. Other\nversions may also be affected. \n\nSOLUTION:\nDo not browse untrusted websites or follow untrusted links. \n\nPROVIDED AND/OR DISCOVERED BY:\nRemco\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-6003"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006334"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "VULHUB",
"id": "VHN-29365"
},
{
"db": "PACKETSTORM",
"id": "61021"
}
],
"trust": 2.07
},
"exploit_availability": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/exploit_availability#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"reference": "https://www.scap.org.cn/vuln/vhn-29365",
"trust": 0.1,
"type": "unknown"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-29365"
}
]
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-6003",
"trust": 2.8
},
{
"db": "SECUNIA",
"id": "27564",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006334",
"trust": 0.8
},
{
"db": "XF",
"id": "38419",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200711-243",
"trust": 0.6
},
{
"db": "BID",
"id": "25972",
"trust": 0.3
},
{
"db": "EXPLOIT-DB",
"id": "30882",
"trust": 0.1
},
{
"db": "SEEBUG",
"id": "SSVID-84240",
"trust": 0.1
},
{
"db": "VULHUB",
"id": "VHN-29365",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "61021",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-29365"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006334"
},
{
"db": "PACKETSTORM",
"id": "61021"
},
{
"db": "NVD",
"id": "CVE-2007-6003"
},
{
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
]
},
"id": "VAR-200711-0147",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-29365"
}
],
"trust": 0.975
},
"last_update_date": "2023-12-18T10:55:01.797000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "SpeedTouch",
"trust": 0.8,
"url": "http://www.technicolor.com/en/hi/about-technicolor/technicolor-at-a-glance/technicolor-s-other-brands/tab/thomson"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-006334"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-79",
"trust": 1.9
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-29365"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006334"
},
{
"db": "NVD",
"id": "CVE-2007-6003"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://secunia.com/advisories/27564"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38419"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-6003"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-6003"
},
{
"trust": 0.6,
"url": "http://xforce.iss.net/xforce/xfdb/38419"
},
{
"trust": 0.3,
"url": "http://www.homehub.bt.com/"
},
{
"trust": 0.3,
"url": "http://www.theregister.co.uk/2007/10/09/bt_home_hub_vuln/"
},
{
"trust": 0.3,
"url": "http://www.gnucitizen.org/blog/call-jacking"
},
{
"trust": 0.3,
"url": "http://www.thomson.net/en/home/minisites/bap/telecom/subcategory.html?category=dsl%20modems"
},
{
"trust": 0.3,
"url": "/archive/1/481835"
},
{
"trust": 0.3,
"url": "/archive/1/486081"
},
{
"trust": 0.3,
"url": "/archive/1/517314"
},
{
"trust": 0.3,
"url": "http://www.gnucitizen.org/blog/bt-home-flub-pwnin-the-bt-home-hub"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/16520/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/27564/"
},
{
"trust": 0.1,
"url": "http://corporate.secunia.com/how_to_buy/38/vi/?ref=secadv"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-29365"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006334"
},
{
"db": "PACKETSTORM",
"id": "61021"
},
{
"db": "NVD",
"id": "CVE-2007-6003"
},
{
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-29365"
},
{
"db": "BID",
"id": "25972"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-006334"
},
{
"db": "PACKETSTORM",
"id": "61021"
},
{
"db": "NVD",
"id": "CVE-2007-6003"
},
{
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-11-15T00:00:00",
"db": "VULHUB",
"id": "VHN-29365"
},
{
"date": "2007-10-08T00:00:00",
"db": "BID",
"id": "25972"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-006334"
},
{
"date": "2007-11-20T16:17:55",
"db": "PACKETSTORM",
"id": "61021"
},
{
"date": "2007-11-15T22:46:00",
"db": "NVD",
"id": "CVE-2007-6003"
},
{
"date": "2007-10-08T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2017-07-29T00:00:00",
"db": "VULHUB",
"id": "VHN-29365"
},
{
"date": "2011-04-04T20:05:00",
"db": "BID",
"id": "25972"
},
{
"date": "2012-12-20T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-006334"
},
{
"date": "2017-07-29T01:33:59.193000",
"db": "NVD",
"id": "CVE-2007-6003"
},
{
"date": "2007-11-16T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Thomson SpeedTouch 716 of cgi/b/ic/connect Vulnerable to cross-site scripting",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-006334"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "xss",
"sources": [
{
"db": "PACKETSTORM",
"id": "61021"
},
{
"db": "CNNVD",
"id": "CNNVD-200711-243"
}
],
"trust": 0.7
}
}
CVE-2018-25039 (GCVE-0-2018-25039)
Vulnerability from cvelistv5 – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RgUrlBlock.asp Persistent cross site scriting
Summary
A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlBlock.asp. The manipulation of the argument BasicParentalNewKeyword with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126700 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.588Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126700"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25039",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:43.007618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:06.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlBlock.asp. The manipulation of the argument BasicParentalNewKeyword with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:27.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126700"
}
],
"title": "Thomson TCW710 RgUrlBlock.asp Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25039",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RgUrlBlock.asp Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlBlock.asp. The manipulation of the argument BasicParentalNewKeyword with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126700",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126700"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25039",
"datePublished": "2022-06-12T07:40:27.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:06.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-25038 (GCVE-0-2018-25038)
Vulnerability from cvelistv5 – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RgDhcp Persistent cross site scriting
Summary
A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The manipulation of the argument PppUserName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126699 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.642Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126699"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25038",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:46.871988Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:13.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The manipulation of the argument PppUserName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:25.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126699"
}
],
"title": "Thomson TCW710 RgDhcp Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25038",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RgDhcp Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The manipulation of the argument PppUserName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126699",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126699"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25038",
"datePublished": "2022-06-12T07:40:25.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:13.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-25037 (GCVE-0-2018-25037)
Vulnerability from cvelistv5 – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RgDdns Persistent cross site scriting
Summary
A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/RgDdns. The manipulation of the argument DdnsHostName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126698 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.598Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126698"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25037",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:49.880002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:19.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/RgDdns. The manipulation of the argument DdnsHostName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack may be launched remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:24.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126698"
}
],
"title": "Thomson TCW710 RgDdns Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25037",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RgDdns Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/RgDdns. The manipulation of the argument DdnsHostName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack may be launched remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126698",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126698"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25037",
"datePublished": "2022-06-12T07:40:24.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:19.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-25036 (GCVE-0-2018-25036)
Vulnerability from cvelistv5 – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RgTime Persistent cross site scriting
Summary
A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/RgTime. The manipulation of the argument TimeServer1/TimeServer2/TimeServer3 with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126697 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.637Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126697"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25036",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:53.023985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:29.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/RgTime. The manipulation of the argument TimeServer1/TimeServer2/TimeServer3 with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:22.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126697"
}
],
"title": "Thomson TCW710 RgTime Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25036",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RgTime Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/RgTime. The manipulation of the argument TimeServer1/TimeServer2/TimeServer3 with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126697",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126697"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25036",
"datePublished": "2022-06-12T07:40:22.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:29.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-25035 (GCVE-0-2018-25035)
Vulnerability from cvelistv5 – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RGFirewallEL Persistent cross site scriting
Summary
A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL. The manipulation of the argument EmailAddress/SmtpServerName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126696 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.562Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126696"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25035",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:56.124070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:36.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL. The manipulation of the argument EmailAddress/SmtpServerName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:21.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126696"
}
],
"title": "Thomson TCW710 RGFirewallEL Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25035",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RGFirewallEL Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL. The manipulation of the argument EmailAddress/SmtpServerName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126696",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126696"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25035",
"datePublished": "2022-06-12T07:40:21.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:36.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-25039 (GCVE-0-2018-25039)
Vulnerability from nvd – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RgUrlBlock.asp Persistent cross site scriting
Summary
A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlBlock.asp. The manipulation of the argument BasicParentalNewKeyword with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126700 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.588Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126700"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25039",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:43.007618Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:06.236Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlBlock.asp. The manipulation of the argument BasicParentalNewKeyword with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:27.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126700"
}
],
"title": "Thomson TCW710 RgUrlBlock.asp Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25039",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RgUrlBlock.asp Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been declared as problematic. This vulnerability affects unknown code of the file /goform/RgUrlBlock.asp. The manipulation of the argument BasicParentalNewKeyword with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack can be initiated remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126700",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126700"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25039",
"datePublished": "2022-06-12T07:40:27.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:06.236Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-25038 (GCVE-0-2018-25038)
Vulnerability from nvd – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RgDhcp Persistent cross site scriting
Summary
A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The manipulation of the argument PppUserName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126699 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.642Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126699"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25038",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:46.871988Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:13.292Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The manipulation of the argument PppUserName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:25.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126699"
}
],
"title": "Thomson TCW710 RgDhcp Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25038",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RgDhcp Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05. It has been classified as problematic. This affects an unknown part of the file /goform/RgDhcp. The manipulation of the argument PppUserName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126699",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126699"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25038",
"datePublished": "2022-06-12T07:40:25.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:13.292Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-25037 (GCVE-0-2018-25037)
Vulnerability from nvd – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RgDdns Persistent cross site scriting
Summary
A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/RgDdns. The manipulation of the argument DdnsHostName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack may be launched remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126698 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.598Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126698"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25037",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:49.880002Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:19.959Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/RgDdns. The manipulation of the argument DdnsHostName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack may be launched remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:24.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126698"
}
],
"title": "Thomson TCW710 RgDdns Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25037",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RgDdns Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this issue is some unknown functionality of the file /goform/RgDdns. The manipulation of the argument DdnsHostName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack may be launched remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126698",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126698"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25037",
"datePublished": "2022-06-12T07:40:24.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:19.959Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-25036 (GCVE-0-2018-25036)
Vulnerability from nvd – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RgTime Persistent cross site scriting
Summary
A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/RgTime. The manipulation of the argument TimeServer1/TimeServer2/TimeServer3 with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). The attack can be launched remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126697 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.637Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126697"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25036",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:53.023985Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:29.134Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/RgTime. The manipulation of the argument TimeServer1/TimeServer2/TimeServer3 with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:22.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126697"
}
],
"title": "Thomson TCW710 RgTime Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25036",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RgTime Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability has been found in Thomson TCW710 ST5D.10.05 and classified as problematic. Affected by this vulnerability is an unknown functionality of the file /goform/RgTime. The manipulation of the argument TimeServer1/TimeServer2/TimeServer3 with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). The attack can be launched remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126697",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126697"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25036",
"datePublished": "2022-06-12T07:40:22.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:29.134Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2018-25035 (GCVE-0-2018-25035)
Vulnerability from nvd – Published: 2022-06-12 07:40 – Updated: 2025-04-15 14:26
VLAI
Title
Thomson TCW710 RGFirewallEL Persistent cross site scriting
Summary
A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL. The manipulation of the argument EmailAddress/SmtpServerName with the input ><script>alert(1)</script> as part of POST Request leads to cross site scripting (Persistent). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Severity
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
- CWE-80 - Basic Cross Site Scripting
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://alquimistadesistemas.com/auditando-router… | x_refsource_MISC |
| https://vuldb.com/?id.126696 | x_refsource_MISC |
Credits
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T12:26:39.562Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://vuldb.com/?id.126696"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2018-25035",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-14T17:11:56.124070Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-15T14:26:36.643Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "TCW710",
"vendor": "Thomson",
"versions": [
{
"status": "affected",
"version": "ST5D.10.05"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "moikano"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL. The manipulation of the argument EmailAddress/SmtpServerName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-80",
"description": "CWE-80 Basic Cross Site Scripting",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-12T07:40:21.000Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://vuldb.com/?id.126696"
}
],
"title": "Thomson TCW710 RGFirewallEL Persistent cross site scriting",
"x_generator": "vuldb.com",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cna@vuldb.com",
"ID": "CVE-2018-25035",
"REQUESTER": "cna@vuldb.com",
"STATE": "PUBLIC",
"TITLE": "Thomson TCW710 RGFirewallEL Persistent cross site scriting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "TCW710",
"version": {
"version_data": [
{
"version_value": "ST5D.10.05"
}
]
}
}
]
},
"vendor_name": "Thomson"
}
]
}
},
"credit": "moikano",
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability, which was classified as problematic, was found in Thomson TCW710 ST5D.10.05. Affected is an unknown function of the file /goform/RGFirewallEL. The manipulation of the argument EmailAddress/SmtpServerName with the input \u003e\u003cscript\u003ealert(1)\u003c/script\u003e as part of POST Request leads to cross site scripting (Persistent). It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used."
}
]
},
"generator": "vuldb.com",
"impact": {
"cvss": {
"baseScore": "3.5",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-80 Basic Cross Site Scripting"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710",
"refsource": "MISC",
"url": "https://alquimistadesistemas.com/auditando-router-thomson-tcw710"
},
{
"name": "https://vuldb.com/?id.126696",
"refsource": "MISC",
"url": "https://vuldb.com/?id.126696"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2018-25035",
"datePublished": "2022-06-12T07:40:21.000Z",
"dateReserved": "2022-06-04T00:00:00.000Z",
"dateUpdated": "2025-04-15T14:26:36.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}