CVE-2017-9492

High

Published: 31/07/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The Comcast firmware on Cisco DPC3939, DPC3939B, DPC3941T, and Arris TG1682G devices does not include the HTTPOnly flag in a Set-Cookie header for administration applications. This increases the risk that remote attackers can access potentially sensitive information via script access to cookies.

Risk Assessment

The absence of the HTTPOnly flag in cookies can lead to session hijacking and exposure of user data, posing a serious security threat to the organization.

Recommendation

It is recommended to update the firmware to the latest version that implements the HTTPOnly flag in the Set-Cookie header to minimize the risk of attacks.

Other vulnerabilities in Cisco DPC3939, Cisco DPC3939B, Cisco DPC3941T, Arris TG1682G

CVE-2017-9521Critical
The firmware of Cisco DPC3939, DPC3939B, DPC3941T, and Arris TG1682G devices contains a vulnerability that allows remote attackers to execute arbitrary code via a specific, but undisclosed, exposed service. The issue pertains only to a single service that is unnecessarily exposed.

Original NVD description (English source)

The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices does not include the HTTPOnly flag in a Set-Cookie header for administration applications, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.