PT-2017-12124 · Cisco · Cisco Ddr2201V1 Adsl2+ Residential Gateway+1

Matheus Bernardes · Published 2017-07-24 · Updated 2019-10-03 · CVE-2017-11589

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco DDR2200 ADSL2+ Residential Gateway version V00.00.03.45.4E Cisco DDR2201v1 ADSL2+ Residential Gateway version V00.00.03.28.3

Description The issue concerns a lack of access control for various command files on the affected devices, including info.html, wancfg.cmd, rtroutecfg.cmd, arpview.cmd, cpuview.cmd, memoryview.cmd, statswan.cmd, statsatm.cmd, scsrvcntr.cmd, scacccntr.cmd, logview.cmd, voicesipview.cmd, usbview.cmd, wlmacflt.cmd, wlwds.cmd, wlstationlist.cmd, HPNAShow.cmd, HPNAView.cmd, qoscls.cmd, qosqueue.cmd, portmap.cmd, scmacflt.cmd, scinflt.cmd, scoutflt.cmd, certlocal.cmd, or certca.cmd.

Recommendations For Cisco DDR2200 ADSL2+ Residential Gateway version V00.00.03.45.4E, restrict access to the mentioned command files to minimize the risk of exploitation. For Cisco DDR2201v1 ADSL2+ Residential Gateway version V00.00.03.28.3, restrict access to the mentioned command files to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2017-11589

Affected Products

Cisco Ddr2200 Adsl2+ Residential Gateway

Cisco Ddr2201V1 Adsl2+ Residential Gateway

References · 3

• https://osv.dev/vulnerability/CVE-2017-11589 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11589 · Security Note
• http://seclists.org/fulldisclosure/2017/Jul/26 · Note