CVE-2006-2560

Sitecom WL-153 router firmware before 1.38 allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic.

• CWE-264

• http://secunia.com/advisories/20183Vendor Advisory
• http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.htmlURL Repurposed
• http://www.securityview.org/how-does-the-upnp-flaw-works.htmlURL Repurposed
• http://www.vupen.com/english/advisories/2006/1912
• http://secunia.com/advisories/20183Vendor Advisory
• http://www.securityview.org/dutch-student-finds-a-bug-in-upnp.htmlURL Repurposed
• http://www.securityview.org/how-does-the-upnp-flaw-works.htmlURL Repurposed
• http://www.vupen.com/english/advisories/2006/1912

Published

May 24, 2006

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2006-2554Buffer overflow in the tell_player_surr_changes function in …
• CVE-2006-2555The parse_command function in Genecys 0.2 and earlier allows…
• CVE-2006-2556Cross-site scripting (XSS) vulnerability in Florian Amrhein …
• CVE-2006-2557PHP remote file inclusion vulnerability in extras/poll/poll.…
• CVE-2006-2558Cross-site scripting (XSS) vulnerability in IpLogger 1.7 and…
• CVE-2006-2559Linksys WRT54G Wireless-G Broadband Router allows remote att…
• CVE-2006-2561Edimax BR-6104K router allows remote attackers to bypass acc…
• CVE-2006-2562ZyXEL P-335WT router allows remote attackers to bypass acces…
• CVE-2006-2563The cURL library (libcurl) in PHP 4.4.2 and 5.1.4 allows att…
• CVE-2006-2564Multiple cross-site scripting (XSS) vulnerabilities in index…
• CVE-2006-2565SQL injection vulnerability in Alstrasoft Article Manager Pr…
• CVE-2006-2566Alstrasoft Article Manager Pro 1.6 allows remote attackers t…