{"cve":"CVE-2011-4499","nvd":{"published":"2011-11-22T11:55:04.683","modified":"2026-06-16T23:34:56.600","status":"Modified","description":"The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware before 4.71.1, and WRT54GS v4 with firmware before 1.06.1 allows remote attackers to establish arbitrary port mappings by sending a UPnP AddPortMapping action in a SOAP request to the WAN interface, related to an \"external forwarding\" vulnerability.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-16"],"references":["http://www.kb.cert.org/vuls/id/357851","http://www.upnp-hacks.org/devices.html","http://www.kb.cert.org/vuls/id/357851","http://www.upnp-hacks.org/devices.html"],"products":["cisco:linksys_wrt54g_router_firmware","cisco:linksys_wrt54gs_router_firmware","linksys:wrt54g","linksys:wrt54gs"],"source":"nvd","synced_at":"2026-10-19T19:59:31.623151214+00:00"},"epss":{"cve":"CVE-2011-4499","score":0.01309,"percentile":0.70625,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}