PT-2011-4966 · Sweex+3 · Sweex Lb000021+5

Published 2011-11-22 · Updated 2013-01-24 · CVE-2011-4502

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Edimax BR-6104K versions prior to 3.25 Edimax 6114Wg version not specified Canyon-Tech CN-WF512 version 1.83 Canyon-Tech CN-WF514 version 2.08 Sitecom WL-153 versions prior to 1.39 Sweex LB000021 version 3.15

Description The issue allows remote attackers to execute arbitrary commands via shell metacharacters in the UPnP IGD implementation.

Recommendations For Edimax BR-6104K, update to firmware version 3.25 or later. For Edimax 6114Wg, at the moment, there is no information about a newer version that contains a fix for this issue. For Canyon-Tech CN-WF512, update to a version later than 1.83. For Canyon-Tech CN-WF514, update to a version later than 2.08. For Sitecom WL-153, update to firmware version 1.39 or later. For Sweex LB000021, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2011-4502

Affected Products

Canyon-Tech Cn-Wf512

Canyon-Tech Cn-Wf514

Edimax 6114Wg

Edimax Br-6104K

Sitecom Wl-153

Sweex Lb000021

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2011-4502 · Security Note
• http://upnp-hacks.org/suspect.html · Note
• http://upnp-hacks.org/devices.html · Note
• http://kb.cert.org/vuls/id/357851 · Note