RCE in Belkin Wemo Home Automation Firmware
CVE-2013-6948
The peerAddresses API in the Belkin WeMo Home Automation firmware before 3949 allows remote attackers to read arbitrary files via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.
Vulnerability class: RCE (Remote Code Execution)
EPSS: 0.016 (73.8th percentile) — read the EPSS interpretation.
Affected products
- Belkin Wemo_home_automation_firmware — versions 2769
- N/a — versions n/a
Weakness classification (CWE)
References
- cret@cert.org (x_refsource_MISC)
- cret@cert.org (US Government Resource, x_refsource_CERT-VN, third-party-advisory)