CVE-2011-3602

Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd)...

6.4 MediumFix available

Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd) before 1.8.2 allows local users to overwrite arbitrary files, and remote attackers to overwrite certain files, via a .. (dot dot) in an interface name. NOTE: this can be leveraged with a symlink to overwrite arbitrary files.

Exploit likelihood

2.85%Up 1.6 points since Feb 4, 2022

What each source reports

NVD Score used 6.4

Record: CVE-2011-3602
CVSS 2.0: 6.4 MediumAV:N/AC:L/Au:N/C:N/I:P/A:P
Weakness: CWE-22
Updated: 2026-11-02

CVE List No score

Record: CVE-2011-3602
Updated: 2026-11-02

EUVDEUVD-2011-3561 No score

Record: EUVD-2011-3561
Updated: 2026-11-03

GitHub AdvisoriesGHSA-jxfr-4vcf-h5vv No score

Directory traversal vulnerability in device-linux.c in the router advertisement daemon (radvd)...

Record: GHSA-jxfr-4vcf-h5vv
Weakness: CWE-22
Updated: 2026-11-02

OSV No score

Record: CVE-2011-3602
Updated: 2026-11-02

OSVDEBIAN-CVE-2011-3602 No score

Record: DEBIAN-CVE-2011-3602
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10558-1 No score

radvd-2.11-1.7 on GA media

These are all security issues fixed in the radvd-2.11-1.7 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10558-1
Updated: 2026-11-02

Affected products

litech router advertisement daemon

Affected packages

Affected packages
Package	Affected	Fixed
`radvd` Debian:12	before 1:1.8-1.1	1:1.8-1.1
`radvd` Debian:13	before 1:1.8-1.1	1:1.8-1.1
`radvd` Debian:14	before 1:1.8-1.1	1:1.8-1.1
`radvd` Debian:6.0 From an advisory covering 4 CVEs	before 1:1.6-1.1, plus listed versions 1:1.6-1	1:1.6-1.1
`radvd` Debian:5.0 From an advisory covering 4 CVEs	before 1:1.1-3.1, plus listed versions 1:1.1-3	1:1.1-3.1
`radvd` openSUSE:Tumbleweed	before 2.11-1.7	2.11-1.7

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2011-3602 is a medium vulnerability (CVSS 6.4) in Litech Router Advertisement Daemon, published October 26, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.85%, the 86th percentile. Fixed in radvd 1:1.8-1.1.