Access Control Flaw in Cisco DDR2200 ADSL2+ Residential Gateways
CVE-2017-11589

9.8CRITICAL

Key Information:

Vendor
Cisco
Status
Residential Gateway Firmware
Vendor
CVE Published:
24 July 2017

Summary

Certain models of Cisco's DDR2200 ADSL2+ Residential Gateways exhibit a lack of access control for numerous sensitive configuration commands. This oversight allows unauthorized users to manipulate device settings and retrieve critical system information remotely, potentially leading to further exploitation or unauthorized access to the network. This vulnerability underscores the importance of implementing proper security measures to safeguard network devices from unauthorized access.

References

http://seclists.org/fulldisclosure/2017/Jul/26
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.