PT-2014-3234 · Belkin · Belkin Wemo Home Automation

Published 2014-02-22 · Updated 2014-03-06 · CVE-2013-6952

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Belkin WeMo Home Automation versions prior to 3949

Description The issue allows remote attackers to spoof firmware updates and execute arbitrary code via crafted signed data, due to a hardcoded GPG key.

Recommendations For versions prior to 3949, update the firmware to version 3949 or later to resolve the issue.

Fix

Weakness Enumeration

CWE-310

Related Identifiers

CVE-2013-6952

Affected Products

Belkin Wemo Home Automation

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2013-6952 · Security Note
• http://kb.cert.org/vuls/id/656302 · Note
• http://ioactive.com/pdfs/IOActive_Belkin-advisory-lite.pdf · Note