Chris Grayson

The issue allows remote attackers to execute arbitrary commands as root by leveraging local network access and connecting to the `syseventd` server. This can be achieved by copying configuration data into a readable filesystem, thus enabling the execution of shell commands with root privileges.

The issue allows remote attackers to easily determine the hidden SSID and passphrase for a Home Security Wi-Fi network. This is due to a problem in the Comcast firmware on the affected devices.

The issue allows remote attackers to discover the CM MAC address by connecting to the device's xfinitywifi hotspot.

The issue allows remote attackers to discover hidden Home Security Wi-Fi networks. This is possible because the Comcast firmware on the devices sets the CM MAC address to a value with a two-byte offset from the MTA/VoIP MAC address, which is embedded into the DNS hostname.

The issue allows local users with command access to read arbitrary files via UPnP access to the `/var/IGD/` directory. This can be exploited by users who have gained command access as a result of previous exploitation.

The issue allows remote attackers to gain unintended access to the Network Processor (NP) 169.254/16 IP network. This is achieved by adding a routing-table entry that specifies the LAN IP address as the router for that network.

The issue allows remote attackers to discover a CM MAC address by sniffing Wi-Fi traffic and performing simple arithmetic calculations.

The issue allows remote attackers to write arbitrary data to a known pathname, specifically /var/tmp/sess *, by leveraging the device's operation in UI dev mode.

The issue allows remote attackers to compute password-of-the-day values.

The issue allows remote attackers to discover a WAN IPv6 IP address by leveraging knowledge of the CM MAC address.

The issue allows remote attackers to access the web UI by establishing a session to the `wan0` WAN IPv6 address and then entering unspecified hardcoded credentials. This `wan0` interface cannot be accessed from the public Internet.

The issue allows configuration changes via CSRF, which can be exploited to make unauthorized changes to the device settings.

The issue allows configuration changes via CSRF, which can be exploited to make unauthorized changes to the device settings.

The Comcast firmware on the affected devices does not set the secure flag for cookies in an https session to an administration application. This makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.

The issue concerns the absence of the HTTPOnly flag in a Set-Cookie header for administration applications. This omission makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.

The issue allows remote attackers to conduct successful forced-pairing attacks between an RF4CE remote and a set-top box by repeatedly transmitting the same pairing code.

The issue allows remote attackers to enable a Remote Web Inspector that is accessible from the public Internet.

The issue allows physically proximate attackers to read arbitrary files on the device. This can be achieved by pressing a specific sequence of buttons on an RF4CE remote to access the diagnostic display and then launching a Remote Web Inspector script.

The issue allows physically proximate attackers to access an SNMP server by connecting a cable to the Ethernet port and establishing communication with the device's link-local IPv6 address.

The issue allows physically proximate attackers to execute arbitrary commands as root. This can be achieved by accessing the diagnostics menu on the set-top box and then posting to a Web Inspector route.