Multiple Cisco ADSL Routers CVE-2017-11589 Multiple Authentication Bypass Vulnerabilities

Bugtraq ID:	100399
Class:	Access Validation Error
CVE:	CVE-2017-11589
Remote:	Yes
Local:	No
Published:	Jul 13 2017 12:00AM
Updated:	Jul 13 2017 12:00AM
Credit:	The Gambler.
Vulnerable:	Cisco Residential Gateway DDR2201v1 ADSL2 00.00.03.28.3 Cisco Residential Gateway DDR2200 ADSL2 00.00.03.45.4E
Not Vulnerable:

Multiple Cisco ADSL Routers CVE-2017-11589 Multiple Authentication Bypass Vulnerabilities

Multiple Cisco ADSL Routers are prone to a multiple authentication-bypass vulnerabilities.

An attacker can exploit this issue to bypass the authentication mechanism and perform unauthorized actions.

The following products are affected :

Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and

Cisco DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3

Multiple Cisco ADSL Routers CVE-2017-11589 Multiple Authentication Bypass Vulnerabilities

The researcher has created a proof-of-concept to demonstrate the issue. Please see the references for more information.

Multiple Cisco ADSL Routers CVE-2017-11589 Multiple Authentication Bypass Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Multiple Cisco ADSL Routers CVE-2017-11589 Multiple Authentication Bypass Vulnerabilities

References:

• Cisco Homepage (Cisco)
  
• CVE request: Multiple vulnerabilities in Cisco DDR2200 Series (Seclists.org)