PT-2014-3230 · Belkin · Belkin Wemo

Published 2014-02-22 · Updated 2014-03-06 · CVE-2013-6948

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Belkin WeMo Home Automation firmware versions prior to 3949

Description The issue concerns an XML External Entity (XXE) problem, allowing remote attackers to read arbitrary files. This is achieved by using an XML document that contains an external entity declaration in conjunction with an entity reference, targeting the peerAddresses API.

Recommendations For versions prior to 3949, update the firmware to version 3949 or later to resolve the issue. As a temporary workaround, consider restricting access to the peerAddresses API until the update is applied.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2013-6948

Affected Products

Belkin Wemo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-6948 · Security Note
• http://kb.cert.org/vuls/id/656302 · Note
• http://ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf · Note