PT-2017-18960 · Arris · Arris Tg1682G

Chris Grayson + 2 · Publicado 2017-07-31 · Atualizado 2017-08-08 · CVE-2017-9490

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arris TG1682G devices with Comcast firmware, versions 10.0.132.SIP.PC20.CT, software version TG1682 2.2p7s2 PROD sey

Description The issue allows configuration changes via CSRF, which can be exploited to make unauthorized changes to the device settings.

Recommendations For Arris TG1682G devices with Comcast firmware, version 10.0.132.SIP.PC20.CT, software version TG1682 2.2p7s2 PROD sey, consider disabling web management access until a patch is available to prevent exploitation via CSRF.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-9490

Produtos afetados

Arris Tg1682G

Referências · 3

• 🔥 https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-33.cross-site-request-forgery.txt · Exploit
• https://osv.dev/vulnerability/CVE-2017-9490 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-9490 · Nota de Segurança