PT-2017-18960 · Arris · Arris Tg1682G

Chris Grayson + 2 · Published 2017-07-31 · Updated 2017-08-08 · CVE-2017-9490

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arris TG1682G devices with Comcast firmware, versions 10.0.132.SIP.PC20.CT, software version TG1682 2.2p7s2 PROD sey

Description The issue allows configuration changes via CSRF, which can be exploited to make unauthorized changes to the device settings.

Recommendations For Arris TG1682G devices with Comcast firmware, version 10.0.132.SIP.PC20.CT, software version TG1682 2.2p7s2 PROD sey, consider disabling web management access until a patch is available to prevent exploitation via CSRF.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-9490

Affected Products

Arris Tg1682G

References · 3

• 🔥 https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-33.cross-site-request-forgery.txt · Exploit
• https://osv.dev/vulnerability/CVE-2017-9490 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9490 · Security Note