CVE-2017-9521

The CVE-2017-9521 entry concerns Comcast firmware in Cisco DPC3939/3939B/3941T and Arris TG1682G devices, where a specific exposed service (unnecessarily exposed per note) enables remote code execution. Affected firmware versions are listed for each device. The root cause is an exposed service th...

CVE-2017-9477

The CVE-2017-9477 entry describes a vulnerability in Cisco DPC3939 firmware (CMST builds: dpc3939-P20-18-v303r20421733-160420a-CMCST and dpc3939-P20-18-v303r20421746-170221a-CMCST) where remote attackers can discover the CM MAC address by connecting to the device’s xfinitywifi hotspot. Affected p...

CVE-2017-9492

The CVE-2017-9492 issue affects Comcast firmware on Cisco DPC3939 (several builds), Cisco DPC3939B, Cisco DPC3941T, and Arris TG1682G devices, where the Set-Cookie header in administration applications omits the HTTPOnly flag. This omissions enables script access to cookies, potentially exposing ...

CVE-2017-9476

The CVE-2017-9476 entry concerns Cisco DPC3939 and Arris TG1682G devices (Comcast firmware on Cisco DPC3939 and eMTA/DOCSIS TG1682G) where a vulnerability allows remote attackers to determine the hidden SSID and passphrase of a Home Security Wi‑Fi network. Public detail in connected sources confi...

CVE-2017-9482

The CVE-2017-9482 entry concerns Cisco DPC3939 firmware (dpc3939-P20-18-v303r20421746-170221a-CMCST). Public records (NVD/CNVD entries) describe remote root access of the Network Processor Linux by enabling a TELNET daemon (via CVE-2017-9479) and connecting, as well as related issues allowing com...

CVE-2017-9486

CVE-2017-9486 affects Cisco DPC3939 devices running the Comcast firmware dpc3939-P20-18-v303r20421746-170221a-CMCST. The published records consistently describe the issue as a vulnerability in the Comcast firmware that allows remote attackers to compute the password-of-the-day (POTD) values via u...

CVE-2017-9479

CVE-2017-9479 affects Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST). The issue allows remote attackers on the local network to execute arbitrary commands as root by connecting to the syseventd server and copying configuration data into a readable ...

CVE-2017-9478

The CVE-2017-9478 entry concerns Cisco DPC3939 firmware (dpc3939-P20-18-v303r20421733-160420a-CMCST and dpc3939-P20-18-v303r20421746-170221a-CMCST). The root cause is that the CM MAC address is set to a value with a two-byte offset from the MTA/VoIP MAC address, and this embedding into DNS hostna...

CVE-2017-9483

CVE-2017-9483 affects Cisco DPC3939 family firmware (e.g., dpc3939-P20-18-v303r20421746-170221a-CMCST). The vulnerability enables arbitrary command execution by NP Linux users to gain root access on the AP Linux system through shell metacharacters in commands. The affected product is a Comcast fi...

CVE-2017-9485

The CVE-2017-9485 entry applies to Cisco DPC3939 firmware (Comcast deployment) and describes a remote arbitrary file-write vulnerability. An attacker can leverage the device’s UI dev mode to write arbitrary data to a known /var/tmp/sess_* pathname. Connected advisories (CNVD-2017-27783, CVE lists...

CVE-2017-9488

The CVE-2017-9488 entry concerns Comcast firmware for Cisco DPC3939 and DPC3941T (dpc3939-P20-18-v303r20421746-170221a-CMCST and DPC3941_2.5s3_PROD_sey). A hardcoded-credentials flaw on the wan0 IPv6 interface allows remote access to the device’s web UI after establishing a session, though this i...

CVE-2017-9491

The CVE-2017-9491 entry affects Comcast firmware on Cisco DPC3939, DPC3939B, DPC3941T, and Arris TG1682G devices. The underlying issue is that cookies used in the administration HTTPS session do not set the secure flag, enabling cookies to be captured if session traffic is intercepted in HTTP. Th...

CVE-2017-9480

The CVE-2017-9480 entry applies to Cisco DPC3939 firmware (version dpc3939-P20-18-v303r20421746-170221a-CMCST). The vulnerability allows local users to read arbitrary files via UPnP access to /var/IGD/ (in the context of users who gained command access through CVE-2017-9479). Affected component/w...

CVE-2017-9481

The CVE-2017-9481 entry describes a vulnerability in Cisco DPC3939 firmware (dpc3939-P20-18-v303r20421746-170221a-CMCST). An attacker can obtain unintended access to the Network Processor’s 169.254/16 IP network by adding a routing-table entry that designates the LAN IP as the router for that net...

CVE-2017-9484

CVE-2017-9484 affects Cisco DPC3939 firmware (dpc3939-P20-18-v303r20421733-160420a-CMCST and dpc3939-P20-18-v303r20421746-170221a-CMCST). The issue allows remote attackers to discover a CM MAC address by sniffing Wi‑Fi traffic and performing simple arithmetic calculations. Root cause is exposure ...

CVE-2017-9487

The CVE-2017-9487 issue affects Cisco DPC3939 and DPC3941T Comcast firmware. A remote attacker could discover a WAN IPv6 address by leveraging knowledge of the CM MAC address, affecting firmware versions dpc3939-P20-18-v303r20421746-170221a-CMCST (DPC3939) and DPC3941_2.5s3_PROD_sey (DPC3941T). T...