CVE-2011-4500 Misconfiguration in n/a
Remote attackers can administer the firewall via SOAP requests if UPnP is enabled, exposing the WAN port to unauthorized control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2011-4500?
CVE-2011-4500 is a high-severity vulnerability in n/a, published on 22 Nov 2011. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The UPnP IGD implementation on the Cisco Linksys WRT54GX with firmware 2.00.05, when UPnP is enabled, configures the SOAP server to listen on the WAN port, which allows remote attackers to administer the firewall via SOAP requests.
Weakness: CWE-16
Which versions are affected by CVE-2011-4500?
It affects 2 products.
Products include Cisco Linksys Wrt54gx Router Firmware, Linksys Wrt54gx.
How do I fix CVE-2011-4500?
No fix has been published for CVE-2011-4500 yet. Limit exposure of the affected software until one is available.
Is CVE-2011-4500 being exploited?
There is no known exploitation of CVE-2011-4500 in the wild and no public exploit code.
Sources
Also known as GHSA-q2fp-xmhf-wjcx.