PT-2014-3230 · Belkin · Belkin Wemo

Publicado 2014-02-22 · Atualizado 2014-03-06 · CVE-2013-6948

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Belkin WeMo Home Automation firmware versions prior to 3949

Description The issue concerns an XML External Entity (XXE) problem, allowing remote attackers to read arbitrary files. This is achieved by using an XML document that contains an external entity declaration in conjunction with an entity reference, targeting the peerAddresses API.

Recommendations For versions prior to 3949, update the firmware to version 3949 or later to resolve the issue. As a temporary workaround, consider restricting access to the peerAddresses API until the update is applied.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2013-6948

Produtos afetados

Belkin Wemo

Referências · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-6948 · Nota de Segurança
• http://kb.cert.org/vuls/id/656302 · Nota
• http://ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf · Nota