CVE-2018-16596

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-12-17 · updated 2026-06-17
Weakness: CWE-787

Description

A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09.04.00 and Internet-Box light prior to v08.05.02 allows remote code execution. No authentication is required to exploit this vulnerability. Sending a simple UDP packet to port 1900 allows an attacker to execute code on a remote device. However, this is only possible if the attacker is inside the LAN. Because of ASLR, the success rate is not 100% and leads instead to a DoS of the UPnP service. The remaining functionality of the Internet Box is not affected. A reboot of the Internet Box is necessary to attempt the exploit again.

Affected products

Swisscom Internet-Box 2 Firmware: through 09.04.00
Swisscom Internet-Box Light Firmware: before 08.05.02 — fixed in 08.05.02
Swisscom Internet-Box Plus Firmware: before 09.04.00 — fixed in 09.04.00
Swisscom Internet-Box Standard Firmware: before 09.04.00 — fixed in 09.04.00

How to fix

Upgrade to a fixed version: Swisscom Internet-Box Light Firmware 08.05.02; Swisscom Internet-Box Plus Firmware 09.04.00; Swisscom Internet-Box Standard Firmware 09.04.00. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2018-16596 or the next vulnerability affects your stack