PT-2017-13261 · Arris+1 · Arris Nvg589+2

Publicado 2017-09-03 · Atualizado 2017-09-13 · CVE-2017-14117

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Média

Vetor base

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Arris NVG589 and NVG599 devices with AT&T U-verse 9.2.2h0d83 firmware

Description The issue concerns an unauthenticated proxy service configured on WAN TCP port 49152. This allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending specific values, including x2axcex01 followed by other predictable values.

Recommendations For Arris NVG589 and NVG599 devices with AT&T U-verse 9.2.2h0d83 firmware, consider using IP Passthrough mode to mitigate the risk of exploitation. As a temporary workaround, restrict access to WAN TCP port 49152 until a patch is available.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2017-14117

Produtos afetados

At&T U-Verse

Arris Nvg589

Arris Nvg599

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/wproxy/att_open_proxy.py · Exploit
• 🔥 https://nomotion.net/blog/sharknatto · Exploit
• https://osv.dev/vulnerability/CVE-2017-14117 · Aviso do Fabricante
• https://threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753 · Nota
• http://securityfocus.com/bid/100585 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-14117 · Nota de Segurança