CVE-2017-11587
HighSummary
There is a directory traversal vulnerability in the filename parameter to the /download.conf URI on Cisco DDR2200 and DDR2201v1 devices.
Risk Assessment
An attacker could gain access to system files, potentially leading to the disclosure of sensitive information or further attacks on the device.
Recommendation
It is recommended to update the device firmware to the latest version to mitigate this vulnerability and restrict access to the management interface.
Other vulnerabilities in Cisco DDR2200 ADSL2+ Residential Gateway, Cisco DDR2201v1 ADSL2+ Residential Gateway
See all- CVE-2017-11589Critical
On Cisco DDR2200 and DDR2201v1 devices, there is no access control for several configuration files, which may lead to unauthorized access to sensitive information.
- CVE-2017-11588Critical
Cisco DDR2200 and DDR2201v1 devices are vulnerable to remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible in /PingMsg.cmd.
Original NVD description (English source)
On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is directory traversal in the filename parameter to the /download.conf URI.