PT-2017-18968 · Motorola+1 · Motorola Mx011Anm+1

Chris Grayson + 2 · Published 2017-07-31 · Updated 2019-10-03 · CVE-2017-9498

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Comcast firmware on Motorola MX011ANM version MX011AN 2.9p6s1 PROD sey Comcast firmware on Xfinity XR11-20 Voice Remote devices (affected versions not specified)

Description The issue allows local users to upload arbitrary firmware images to an XR11 device by leveraging root access, due to the lack of a protection mechanism involving digital signatures for the firmware.

Recommendations For Comcast firmware on Motorola MX011ANM version MX011AN 2.9p6s1 PROD sey, consider restricting root access to prevent arbitrary firmware uploads until a patch is available. For Comcast firmware on Xfinity XR11-20 Voice Remote devices, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-354

Related Identifiers

CVE-2017-9498

Affected Products

Motorola Mx011Anm

Xfinity Xr11-20 Voice Remote

References · 3

• https://osv.dev/vulnerability/CVE-2017-9498 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-9498 · Security Note
• https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-42.remote-OTA.txt · Note