PT-2017-12124 · Cisco · Cisco Ddr2201V1 Adsl2+ Residential Gateway+1

Matheus Bernardes · Publicado 2017-07-24 · Atualizado 2019-10-03 · CVE-2017-11589

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco DDR2200 ADSL2+ Residential Gateway version V00.00.03.45.4E Cisco DDR2201v1 ADSL2+ Residential Gateway version V00.00.03.28.3

Description The issue concerns a lack of access control for various command files on the affected devices, including info.html, wancfg.cmd, rtroutecfg.cmd, arpview.cmd, cpuview.cmd, memoryview.cmd, statswan.cmd, statsatm.cmd, scsrvcntr.cmd, scacccntr.cmd, logview.cmd, voicesipview.cmd, usbview.cmd, wlmacflt.cmd, wlwds.cmd, wlstationlist.cmd, HPNAShow.cmd, HPNAView.cmd, qoscls.cmd, qosqueue.cmd, portmap.cmd, scmacflt.cmd, scinflt.cmd, scoutflt.cmd, certlocal.cmd, or certca.cmd.

Recommendations For Cisco DDR2200 ADSL2+ Residential Gateway version V00.00.03.45.4E, restrict access to the mentioned command files to minimize the risk of exploitation. For Cisco DDR2201v1 ADSL2+ Residential Gateway version V00.00.03.28.3, restrict access to the mentioned command files to minimize the risk of exploitation.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2017-11589

Produtos afetados

Cisco Ddr2200 Adsl2+ Residential Gateway

Cisco Ddr2201V1 Adsl2+ Residential Gateway

Referências · 3

• http://seclists.org/fulldisclosure/2017/Jul/26 · Nota
• https://osv.dev/vulnerability/CVE-2017-11589 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-11589 · Nota de Segurança