PT-2017-13261 · Arris+1 · Arris Nvg589+2

Published 2017-09-03 · Updated 2017-09-13 · CVE-2017-14117

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Arris NVG589 and NVG599 devices with AT&T U-verse 9.2.2h0d83 firmware

Description The issue concerns an unauthenticated proxy service configured on WAN TCP port 49152. This allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending specific values, including x2axcex01 followed by other predictable values.

Recommendations For Arris NVG589 and NVG599 devices with AT&T U-verse 9.2.2h0d83 firmware, consider using IP Passthrough mode to mitigate the risk of exploitation. As a temporary workaround, restrict access to WAN TCP port 49152 until a patch is available.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-14117

Affected Products

At&T U-Verse

Arris Nvg589

Arris Nvg599

References · 6

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/wproxy/att_open_proxy.py · Exploit
• 🔥 https://nomotion.net/blog/sharknatto · Exploit
• https://osv.dev/vulnerability/CVE-2017-14117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-14117 · Security Note
• https://threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753 · Note
• http://securityfocus.com/bid/100585 · Note