CVE-2011-3602 in router advertisement daemon
Summary
by MITRE
Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/12/2026
The CVE-2011-3602 vulnerability represents a critical directory traversal flaw in the router advertisement daemon radvd version 1.8.2 and earlier, exposing systems to both local and remote exploitation vectors. This vulnerability specifically affects the device-linux.c component of the daemon, which handles interface name processing and file operations. The flaw manifests when the daemon processes interface names containing .. (dot dot) sequences, allowing attackers to manipulate file paths and gain unauthorized access to the file system. The vulnerability stems from insufficient input validation and path sanitization within the daemon's processing logic, creating a pathway for arbitrary file overwrites that can compromise system integrity and confidentiality.
The technical exploitation of this vulnerability leverages the inherent weakness in how the radvd daemon handles interface name parameters, particularly when these names contain directory traversal sequences. When a malicious user provides an interface name with .. components, the daemon fails to properly validate or sanitize these inputs before using them in file system operations. This allows attackers to craft interface names that traverse up directory trees and target files outside the intended scope. The vulnerability is particularly dangerous because it can be exploited locally by users with system access and remotely by network attackers who can influence the daemon's configuration or interface handling processes. The exploitation becomes even more severe when combined with symbolic link manipulation, as attackers can use symlinks to redirect file operations to arbitrary locations within the file system.
The operational impact of CVE-2011-3602 extends beyond simple file overwrites to encompass complete system compromise and potential data exfiltration. Local attackers can leverage this vulnerability to modify critical system files, potentially gaining root privileges or disrupting essential network services. Remote exploitation capabilities mean that attackers can compromise systems from outside the local network, making this vulnerability particularly dangerous in enterprise environments where routers and network infrastructure are exposed to external threats. The vulnerability can be exploited to overwrite configuration files, system binaries, or log files, potentially leading to persistent backdoors or complete service disruption. Network administrators face significant challenges in detecting and mitigating this vulnerability due to its subtle nature and the fact that it can be triggered through legitimate network management interfaces.
The vulnerability aligns with CWE-22 Directory Traversal and follows patterns consistent with ATT&CK technique T1059 Command and Scripting Interpreter, as the exploitation involves manipulating system interfaces and file operations to achieve unauthorized access. The weakness creates a direct path for privilege escalation and persistent access to network infrastructure, making it a significant concern for network security. Organizations should prioritize immediate patching of affected radvd versions and implement network segmentation to limit exposure. Additional mitigations include restricting interface name inputs, implementing proper file system permissions, and monitoring for unusual file system operations. The vulnerability demonstrates the critical importance of input validation in network daemon applications and highlights the need for comprehensive security testing of system services that handle user-provided parameters.