PT-2007-6456 · 3Com · 3Com 3Crwer100-75

Published 2007-10-12 · Updated 2018-10-15 · CVE-2007-5419

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: 3Com 3CRWER100-75 router version 1.2.10ww

Description: The issue allows remote attackers to access the web management interface by setting up a virtual server on port 80, potentially exposing the router to unintended incoming traffic. This occurs when an optional virtual server is enabled without selecting specific options to restrict source IP addresses on the external interface.

Recommendations: For version 1.2.10ww, consider disabling the virtual server feature until a configuration or software update is available to restrict incoming traffic to specified IP addresses. Restrict access to the web management interface by configuring the virtual server to only accept traffic from trusted source IP addresses.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2007-5419

Affected Products

3Com 3Crwer100-75

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-5419 · Security Note
• http://osvdb.org/43657 · Note
• http://securityfocus.com/bid/26009 · Note
• http://securityfocus.com/archive/1/481977/100/0/threaded · Note
• http://securityreason.com/securityalert/3217 · Note