Insufficient Compartmentalization in Edimax BR-6208AC V1 Devices
CVE-2019-13269

8.8HIGH

Key Information:

Vendor

Edimax

Status
Br-6208ac V1 Firmware
Vendor
CVE Published:
27 August 2019

What is CVE-2019-13269?

Edimax BR-6208AC V1 devices exhibit a significant flaw due to insufficient compartmentalization between host and guest networks. This weakness allows the potential for cross-network data leakage. When a DHCP Request is made, the device erroneously sends NAK messages to both network segments with the same Transaction ID found in the original request. This misconfiguration can allow attackers to exploit the protocol, leading to unauthorized data transmission between networks, effectively compromising the integrity and confidentiality of network communications.

References

https://orenlab.sise.bgu.ac.il/publications/CrossRouter
x_refsource_MISC
https://www.usenix.org/system/files/woot19-paper_ovadia.pdf
x_refsource_MISC

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2019-13269 : Insufficient Compartmentalization in Edimax BR-6208AC V1 Devices