CVE-2011-4502: canyon-tech cn-wf512 OS Command Injection

Vulnerability summary

CVE-2011-4502 is a high (CVSS 10.0) OS Command Injection vulnerability in canyon-tech cn-wf512. EPSS estimates a 5.48% chance of exploitation in the next 30 days, higher than 92.6% of scored vulnerabilities.

Timeline

1. 22-11-2011
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

The UPnP IGD implementation in Edimax EdiLinux on the Edimax BR-6104K with firmware before 3.25, Edimax 6114Wg, Canyon-Tech CN-WF512 with firmware 1.83, Canyon-Tech CN-WF514 with firmware 2.08, Sitecom WL-153 with firmware before 1.39, and Sweex LB000021 with firmware 3.15 allows remote attackers to execute arbitrary commands via shell metacharacters.

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.