PT-2019-13225 · Edimax · Edimax Br-6208Ac
Published
2019-08-27
·
Updated
2019-09-04
·
CVE-2019-13270
CVSS v2.0
5.8
Medium
| Vector | AV:A/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Edimax BR-6208AC version V1
Description
The issue concerns insufficient compartmentalization between a host network and a guest network established by the same device. To transfer data from the host network to the guest network, a sender joins and then leaves an IGMP group. After leaving, the router creates an IGMP Membership Query packet with the Group IP and sends it to both the host and guest networks. The data is transferred within the Group IP field, which is completely controlled by the sender.
Recommendations
For Edimax BR-6208AC version V1, consider restricting access to the IGMP protocol to minimize the risk of exploitation. As a temporary workaround, limiting the ability to join and leave IGMP groups may help mitigate the issue until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
RCE
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Edimax Br-6208Ac