Arbitrary Command Execution in Motorola Set-Top Box Firmware by Comcast
CVE-2017-9497

6.8MEDIUM

Key Information:

Vendor
Cisco
Status
Mx011anm Firmware
Vendor
CVE Published:
31 July 2017

Summary

The firmware of Motorola set-top boxes provided by Comcast is susceptible to an arbitrary command execution vulnerability. Attackers in physical proximity can exploit this flaw by accessing the diagnostics menu on the device. Once in the menu, they can issue commands through a Web Inspector route, effectively gaining root access to the system and compromising its integrity. This vulnerability raises significant security concerns for users relying on these devices.

References

https://github.com/BastilleResearch/CableTap/blob/master/...
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.