CVE-2017-11589
CriticalSummary
On Cisco DDR2200 and DDR2201v1 devices, there is no access control for several configuration files, which may lead to unauthorized access to sensitive information.
Risk Assessment
The lack of access control poses a risk that unauthorized users may gain access to critical data and configurations, potentially compromising network security.
Recommendation
It is recommended to implement appropriate access control mechanisms for the mentioned files to secure the devices against unauthorized access.
Other vulnerabilities in Cisco DDR2200 ADSL2+ Residential Gateway, Cisco DDR2201v1 ADSL2+ Residential Gateway
See all- CVE-2017-11587High
There is a directory traversal vulnerability in the filename parameter to the /download.conf URI on Cisco DDR2200 and DDR2201v1 devices.
- CVE-2017-11588Critical
Cisco DDR2200 and DDR2201v1 devices are vulnerable to remote command execution via shell metacharacters in the pingAddr parameter to the waitPingqry.cgi URI. The command output is visible in /PingMsg.cmd.
Original NVD description (English source)
On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is no access control for info.html, wancfg.cmd, rtroutecfg.cmd, arpview.cmd, cpuview.cmd, memoryview.cmd, statswan.cmd, statsatm.cmd, scsrvcntr.cmd, scacccntr.cmd, logview.cmd, voicesipview.cmd, usbview.cmd, wlmacflt.cmd, wlwds.cmd, wlstationlist.cmd, HPNAShow.cmd, HPNAView.cmd, qoscls.cmd, qosqueue.cmd, portmap.cmd, scmacflt.cmd, scinflt.cmd, scoutflt.cmd, certlocal.cmd, or certca.cmd.