TI-2007-05206 Aliases CVE-2007-5419 GHSA-xh3j-9hv7-3jxm

The 3Com 3CRWER100-75 router with 1.2.10ww software, when enabling an optional virtual…

MEDIUM 47CWE-16Published 2007-10-12 · Updated 2024-08-07

Key facts

Attack vector: Network
Privileges required: None
User interaction: — Not recorded in CVSS 2.0
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: Complete · Complete · Complete
Fix status: No fix listed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA.

Summary

The 3Com 3CRWER100-75 router with 1.2.10ww software, when enabling an optional virtual server, configures this server to accept all source IP addresses on the external (Internet) interface unless the user selects other options, which might expose the router to unintended incoming traffic from remote attackers, as demonstrated by setting up a virtual server on port 80, which allows remote attackers to access the web management interface.

Why it matters now

EPSS 0.02169 82nd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:h:3com:3crwe554g72t:3crwer100-75::1.2.10ww:::::	3crwer100-75	Vulnerable	3com

cpe:2.3:h:3com:3crwe554g72t:3crwer100-75:*:1.2.10ww:*:*:*:*:* Versions 3crwer100-75 Vulnerable ·3com

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2007-5419
2026-10-03 Alias added: GHSA-xh3j-9hv7-3jxm

References

Advisory 1

3217

Other 1

43657

TI-2007-05207 The 3Com 3CRWER100-75 router with 1.2.10ww software, when remote management is disabled… CVSS 2.0LOW 2.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences