PT-2019-13226 · Edimax · Edimax Br-6208Ac
Published
2019-08-27
·
Updated
2020-08-24
·
CVE-2019-13271
CVSS v2.0
5.8
Medium
| Vector | AV:A/AC:L/Au:N/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
Edimax BR-6208AC version V1
Description
The issue concerns insufficient compartmentalization between a host network and a guest network established by the same device. These devices forward ARP requests between the host and guest networks, allowing for potential data leakage. An attacker can exploit this by issuing an ARP request to an arbitrary computer on the network, potentially using the leakage as a direct covert channel. The data payload can be either the lower 8 bits of the IP address or the entire 32 bits, depending on the device's restriction of ARP forwarding.
Recommendations
For Edimax BR-6208AC version V1, as a temporary workaround, consider restricting ARP forwarding to requests destined for the network's subnet mask to minimize the risk of exploitation. However, at the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Edimax Br-6208Ac