What’s Vulnerable › Vulnerabilities

CVE-2009-2189

• Severity: medium (CVSS 6.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.8% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2010-12-22 · updated 2026-06-16
• Weakness: CWE-399

Description

The ICMPv6 implementation on the Apple Time Capsule, AirPort Extreme Base Station, and AirPort Express Base Station with firmware before 7.5.2 does not limit the rate of (1) Router Advertisement and (2) Neighbor Discovery packets, which allows remote attackers to cause a denial of service (resource consumption and device restart) by sending many packets.

Affected products

• Apple Airport Express: all versions
• Apple Airport Express Base Station Firmware: through 7.4.2; 3.84, 4.0.9, 6.1, 6.3, 7.3.2, 7.4.1
• Apple Airport Extreme: all versions
• Apple Airport Extreme Base Station Firmware: 5.5, 5.7
• Apple Time Capsule: all versions

References

• http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html
• http://support.apple.com/kb/HT4298
• http://www.securitytracker.com/id?1024907
• http://lists.apple.com/archives/security-announce/2010//Dec/msg00001.html
• http://support.apple.com/kb/HT4298
• http://www.securitytracker.com/id?1024907

Get alerted when CVE-2009-2189 or the next vulnerability affects your stack