Design/Logic Flaw

2017-07-2400:29:00

PRIOn knowledge base

www.prio-n.com

9.5 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

61.1%

JSON

On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is no access control for info.html, wancfg.cmd, rtroutecfg.cmd, arpview.cmd, cpuview.cmd, memoryview.cmd, statswan.cmd, statsatm.cmd, scsrvcntr.cmd, scacccntr.cmd, logview.cmd, voicesipview.cmd, usbview.cmd, wlmacflt.cmd, wlwds.cmd, wlstationlist.cmd, HPNAShow.cmd, HPNAView.cmd, qoscls.cmd, qosqueue.cmd, portmap.cmd, scmacflt.cmd, scinflt.cmd, scoutflt.cmd, certlocal.cmd, or certca.cmd.

CPENameOperatorVersion
residential_gateway_firmwareeqddr2200bnaannexafccv0.0.3.45.4e
residential_gateway_firmwareeqddr2201v1naannexafccv0.0.3.28.3

CPE	Name	Operator	Version
	residential_gateway_firmware	eq	ddr2200bnaannexafccv0.0.3.45.4e
	residential_gateway_firmware	eq	ddr2201v1naannexafccv0.0.3.28.3

References

seclists.org/fulldisclosure/2017/Jul/26