PT-2011-4969 · Thomson · Speedtouch

Daniel Garcia · Published 2011-11-22 · Updated 2012-03-08 · CVE-2011-4505

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SpeedTouch 5x6 devices with firmware prior to 6.2.29

Description The issue allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface. This is related to an external forwarding issue.

Recommendations For SpeedTouch 5x6 devices with firmware prior to 6.2.29, update the firmware to version 6.2.29 or later to resolve the issue. As a temporary workaround, consider restricting access to the WAN interface to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-16

Related Identifiers

CVE-2011-4505

Affected Products

Speedtouch

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2011-4505 · Security Note
• http://toor.do/DEFCON-19-Garcia-UPnP-Mapping-WP.pdf · Note
• http://kb.cert.org/vuls/id/357851 · Note