Vulnerabilities > CVE-2011-4501 - Configuration vulnerability in multiple products

CVSS 10.0 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

COMPLETE

Integrity impact

COMPLETE

Availability impact

COMPLETE

network

low complexity

critical

NVD

Published: 2011-11-22

Updated: 2013-01-24

Summary

The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an "external forwarding" vulnerability.

Vulnerable Configurations

Part	Description	Count
OS	Edimax Edimax BR 6104K Router Firmware 3.21 Edimax 6114Wg Router Firmware 1.83 Edimax 6114Wg Router Firmware 2.08	3
OS	Canyon-Tech Canyon Tech CN Wf512 Router Firmware 1.83 Canyon Tech CN Wf514 Router Firmware 2.08	2
OS	Sitecom Sitecom WL 153 Router Firmware 1.31 Sitecom WL 153 Router Firmware 1.34	2
OS	Sweex Sweex Lb000021 Router Firmware 3.15	1
Hardware	Edimax Edimax BR 6104K - Edimax 6114Wg -	2
Hardware	Canyon-Tech Canyon Tech CN Wf512 - Canyon Tech CN Wf514 -	2
Hardware	Sitecom Sitecom WL 153 -	1
Hardware	Sweex Sweex Lb000021 -	1

Common Weakness Enumeration (CWE)

CWE-16 - Configuration

Summary

Vulnerable Configurations

Common Weakness Enumeration (CWE)

References