CVE-2017-5135
CriticalSummary
Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization. The Technicolor DPC3928SL with specific firmware can be reached from the Internet using any SNMP community string.
Risk Assessment
This vulnerability allows unauthorized access to the device, potentially leading to serious security breaches within the organization's network.
Recommendation
It is recommended to block SNMP access from the Internet and update the device firmware to the latest version to minimize risk.
Original NVD description (English source)
Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases. The Technicolor (formerly Cisco) DPC3928SL with firmware D3928SL-P15-13-A386-c3420r55105-160127a could be reached by any SNMP community string from the Internet; also, you can write in the MIB because it provides write properties, aka Stringbleed. NOTE: the string-bleed/StringBleed-CVE-2017-5135 GitHub repository is not a valid reference as of 2017-04-27; it contains Trojan horse code purported to exploit this vulnerability.