Cisco DPC2100 Multiple Security Bypass and Cross-Site Request Forgery Vulnerabilities
BID:40346
Info
Cisco DPC2100 Multiple Security Bypass and Cross-Site Request Forgery Vulnerabilities
| Bugtraq ID: | 40346 |
| Class: | Unknown |
| CVE: |
CVE-2010-2025 CVE-2010-2026 |
| Remote: | Yes |
| Local: | No |
| Published: | May 24 2010 12:00AM |
| Updated: | May 24 2010 07:32PM |
| Credit: | Dan Rosenberg |
| Vulnerable: |
Cisco DPC2100R2 2.0.2 r1256-060303 |
| Not Vulnerable: |
Cisco DPC2100R2 2.0.2 r1256-100324as |
Discussion
Cisco DPC2100 Multiple Security Bypass and Cross-Site Request Forgery Vulnerabilities
Cisco DPC2100 (formerly Scientific Atlanta DPC2100) is prone to multiple security-bypass and cross-site request-forgery vulnerabilities.
Successful exploits may allow attackers to run privileged commands on the affected device, change configuration settings, modify device firmware, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible.
Firmware versions prior to 2.0.2.r1256-100324as are vulnerable.
Cisco DPC2100 (formerly Scientific Atlanta DPC2100) is prone to multiple security-bypass and cross-site request-forgery vulnerabilities.
Successful exploits may allow attackers to run privileged commands on the affected device, change configuration settings, modify device firmware, cause denial-of-service conditions, or inject arbitrary script code. Other attacks are also possible.
Firmware versions prior to 2.0.2.r1256-100324as are vulnerable.
Exploit / POC
Cisco DPC2100 Multiple Security Bypass and Cross-Site Request Forgery Vulnerabilities
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
The following exploit is available:
To exploit these issues, an attacker must entice an unsuspecting victim into following a malicious URI.
The following exploit is available:
Solution / Fix
Cisco DPC2100 Multiple Security Bypass and Cross-Site Request Forgery Vulnerabilities
Solution:
Updates are reported to be available; please contact the vendor for more information.
Solution:
Updates are reported to be available; please contact the vendor for more information.
References
Cisco DPC2100 Multiple Security Bypass and Cross-Site Request Forgery Vulnerabilities
References:
References:
- Cisco Homepage (Cisco )
- Scientific Atlanta DPC2100 WebSTAR Cable Modem vulnerabilities (Dan Rosenberg)