CVE-2017-9521
CriticalSummary
The firmware of Cisco DPC3939, DPC3939B, DPC3941T, and Arris TG1682G devices contains a vulnerability that allows remote attackers to execute arbitrary code via a specific, but undisclosed, exposed service. The issue pertains only to a single service that is unnecessarily exposed.
Risk Assessment
This vulnerability poses a serious security risk, allowing attackers to remotely take control of devices, potentially leading to data loss or disruption of network operations.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and minimize the exposure of unnecessary services.
Original NVD description (English source)
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows remote attackers to execute arbitrary code via a specific (but unstated) exposed service. NOTE: the scope of this CVE does NOT include the concept of "Unnecessary Services" in general; the scope is only a single service that is unnecessarily exposed, leading to remote code execution. The details of that service might be disclosed at a later date.