Unscored severity · published Dec 22, 2010
CVE-2009-2189
The ICMPv6 implementation on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 does not limit the rate of (1)…
–
CVSS
0.8%
EPSS
No
On KEV
Description
The ICMPv6 implementation on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 does not limit the rate of (1) Router Advertisement and (2) Neighbor Discovery packets, which allows remote attackers to cause a denial of service (resource consumption and device restart) by sending many packets.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AE
Airport Express · Apple
All versions, or not specified · source: NVD
AE
Airport Express Base Station Firmware · Apple
through 7.4.2; 3.84; 4.0.9; 6.1; 6.3; 7.3.2; +1 more · source: NVD
AE
Airport Extreme · Apple
All versions, or not specified · source: NVD
AE
Airport Extreme Base Station Firmware · Apple
5.5; 5.7 · source: NVD
TC
Time Capsule · Apple
All versions, or not specified · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2189
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2189
Patch
http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html
Patch
http://support.apple.com/kb/HT4298
www.securitytracker.com
http://www.securitytracker.com/id?1024907
More from Airport Express
–
CVE-2010-0039
The Application-Level Gateway (ALG) on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 modifies PORT commands in…
–
CVE-2010-1804
Unspecified vulnerability in the network bridge functionality on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2…
–
CVE-2010-0962
The FTP proxy server in Apple AirPort Express, AirPort Extreme, and Time Capsule with firmware 7.5 does not restrict the IP address and port specified in a PORT command from a…
–
CVE-2005-3714
The network interface for Apple AirPort Express 6.x before Firmware Update 6.3, and AirPort Extreme 5.x before Firmware Update 5.7, allows remote attackers to cause a denial of…
–
CVE-2005-0289
Apple AirPort Express prior to 6.1.1 and Extreme prior to 5.5.1, configured as a Wireless Data Service (WDS), allows remote attackers to cause a denial of service (device freeze)…