PT-2017-18959

CVE-2017-9489

Published

2017-07-31

Updated

2021-09-13

Description by

CVSS 3.1

8.8

High

MetricsAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Cisco DPC3939B version dpc3939b-v303r204217-150321a-CMCST

Description The issue allows configuration changes via CSRF, which can be exploited to make unauthorized changes to the device settings.

Recommendations For Cisco DPC3939B version dpc3939b-v303r204217-150321a-CMCST, as a temporary workaround, consider implementing CSRF protection measures, such as validating request tokens, to prevent unauthorized configuration changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Chris Grayson

Logan Lamb

Marc Newlin

Vendors

Affected products

Weakness enumeration

CWE-352: Cross-Site Request Forgery (CSRF)

Related identifiers