CVE-2017-9489

The CVE-2017-9489 entry concerns the Comcast firmware running on Cisco DPC3939B devices (firmware version dpc3939b-v303r204217-150321a-CMCST). Public documentation in CNVD/NVD confirms a Cross-Site Request Forgery (CSRF) vulnerability that enables configuration changes on affected devices. The ex...

CVE-2017-9497

The CVE-2017-9497 entry concerns Comcast firmware on Motorola MX011ANM devices (firmware MX011AN_2.9p6s1_PROD_sey). Affected component is the device firmware exposed via the diagnostics Web Inspector route; when a user with physical proximity pulls up the diagnostics menu, an attacker can post to...

CVE-2017-9487

The CVE-2017-9487 issue affects Cisco DPC3939 and DPC3941T Comcast firmware. A remote attacker could discover a WAN IPv6 address by leveraging knowledge of the CM MAC address, affecting firmware versions dpc3939-P20-18-v303r20421746-170221a-CMCST (DPC3939) and DPC3941_2.5s3_PROD_sey (DPC3941T). T...

CVE-2017-9491

The CVE-2017-9491 entry affects Comcast firmware on Cisco DPC3939, DPC3939B, DPC3941T, and Arris TG1682G devices. The underlying issue is that cookies used in the administration HTTPS session do not set the secure flag, enabling cookies to be captured if session traffic is intercepted in HTTP. Th...

CVE-2017-9494

The CVE-2017-9494 issue affects Comcast firmware on Motorola MX011ANM devices (firmware MX011AN_2.9p6s1_PROD_sey). The root concern is that a remote attacker can enable the Remote Web Inspector, which becomes accessible from the public Internet. Public details describe the device class and firmwa...

CVE-2017-9485

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to write arbitrary data to a known /var/tmp/sess pathname by leveraging the device's operation in UI dev mode...

CVE-2017-9477

The CVE-2017-9477 entry describes a vulnerability in Cisco DPC3939 firmware (CMST builds: dpc3939-P20-18-v303r20421733-160420a-CMCST and dpc3939-P20-18-v303r20421746-170221a-CMCST) where remote attackers can discover the CM MAC address by connecting to the device’s xfinitywifi hotspot. Affected p...

CVE-2017-9475

CVE-2017-9475 affects Comcast XFINITY WiFi Home Hotspot devices. It describes a remote‑level vulnerability where an attacker can spoof the identities of Comcast customers by forging MAC addresses. The available description does not specify the exact component, firmware version, or root cause beyo...

CVE-2017-9493: Undefined Security Weakness

The Comcast firmware on Motorola MX011ANM firmware version MX011AN2.9p6s1PRODsey devices allows remote attackers to conduct successful forced-pairing attacks between an RF4CE remote and a set-top box by repeatedly transmitting the same pairing code...

CVE-2017-9477: Exposure of Sensitive Information to an Unauthorized Actor

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST and DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to discover the CM MAC address by connecting to the device's xfinitywifi hotspot...

CVE-2017-9494: Incorrect Permission Assignment for Critical Resource

The Comcast firmware on Motorola MX011ANM firmware version MX011AN2.9p6s1PRODsey devices allows remote attackers to enable a Remote Web Inspector that is accessible from the public Internet...

CVE-2017-9489: Cross-Site Request Forgery (CSRF)

The Comcast firmware on Cisco DPC3939B firmware version dpc3939b-v303r204217-150321a-CMCST devices allows configuration changes via CSRF...

CVE-2017-9475: Improper Authentication

Comcast XFINITY WiFi Home Hotspot devices allow remote attackers to spoof the identities of Comcast customers via a forged MAC address...

CVE-2017-9483: Improper Neutralization of Special Elements used in an OS Command

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows Network Processor NP Linux users to obtain root access to the Application Processor AP Linux system via shell metacharacters in commands...

CVE-2017-9497: Improper Input Validation

The Comcast firmware on Motorola MX011ANM firmware version MX011AN2.9p6s1PRODsey devices allows physically proximate attackers to execute arbitrary commands as root by pulling up the diagnostics menu on the set-top box, and then posting to a Web Inspector route...

CVE-2017-9490: Cross-Site Request Forgery (CSRF)

The Comcast firmware on Arris TG1682G eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG16822.2p7s2PRODsey devices allows configuration changes via CSRF...

CVE-2017-9485: Undefined Security Weakness

The Comcast firmware on Cisco DPC3939 firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST devices allows remote attackers to write arbitrary data to a known /var/tmp/sess pathname by leveraging the device's operation in UI dev mode...

R7-2016-23, R7-2016-26, R7-2016-27: Multiple Home Security Vulnerabilities

Executive Summary In October of 2016, former Rapid7 researcher Phil Bosco discovered a number of relatively low-risk vulnerabilities and issues involving home security systems that are common throughout the United States, and which have significant WiFi or Ethernet capabilities. The three systems...

hotspots.wifi.comcast.com XSS vulnerability

Vulnerable URL: http://hotspots.wifi.comcast.com/mobile/?txtQuick=A=1=mobile%27,true;pr\u006fmp\u0074OPENBUGBOUNTY;// Details: Description| Value ---|--- Patched:| No Latest check for patch:| 12.08.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not...

Comcast XFINITY Home Security System Security Bypass Vulnerability

The Comcast XFINITY Home Security System is a complete home security system. The Comcast XFINITY Home Security System failed to properly maintain base station communications, allowing an attacker to disrupt sensor functionality by jamming ZigBee 2.4 GHz communications...