PT-2006-3506 · Sitecom · Sitecom Wl-153

Published 2006-05-24 · Updated 2024-02-14 · CVE-2006-2560

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Sitecom WL-153 router firmware versions prior to 1.38

Description The issue allows remote attackers to bypass access restrictions and conduct unauthorized operations. This is achieved via a UPnP request with a modified InternalClient parameter, which is not validated. For example, an attacker can use the AddPortMapping function to forward arbitrary traffic.

Recommendations For versions prior to 1.38, update the firmware to version 1.38 or later to resolve the issue. As a temporary workaround, consider restricting access to the UPnP functionality until the update is applied. Avoid using the AddPortMapping function in the affected API endpoint until the issue is resolved.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2006-2560

Affected Products

Sitecom Wl-153

References · 5

• http://secunia.com/advisories/20183 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2006-2560 · Security Note
• http://vupen.com/english/advisories/2006/1912 · Note
• http://securityview.org/dutch-student-finds-a-bug-in-upnp.html · Note
• http://securityview.org/how-does-the-upnp-flaw-works.html · Note