PT-2010-3644 · Cisco · Cisco Scientific Atlanta Webstar Dpc2100R2

Publicado 2010-05-26 · Atualizado 2010-05-27 · CVE-2010-2025

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem version 2.0.2r1256-060303

Description The issue affects the web interface of the Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem, allowing remote attackers to hijack the authentication of administrators. This can lead to various malicious actions, including resetting the modem, erasing the firmware, changing the administrative password, installing modified firmware, or changing the access level. For example, an attacker could send a request to the /goform/ aslvl endpoint to change the access level.

Recommendations For Cisco Scientific Atlanta WebSTAR DPC2100R2 cable modem version 2.0.2r1256-060303, consider restricting access to the web interface until a fix is available. As a temporary workaround, avoid using the web interface for sensitive operations, such as changing the administrative password or installing firmware, until the issue is resolved.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2010-2025

Produtos afetados

Cisco Scientific Atlanta Webstar Dpc2100R2

Referências · 4

• 🔥 https://exploit-db.com/exploits/34033 · Exploit
• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0322.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2025 · Nota de Segurança
• http://securityfocus.com/bid/40346 · Nota