Information disclosure in Cisco Dpc3939
CVE-2017-9491
The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices does not set the secure flag for cookies in an https session to an administration application, which makes it easier for remote attackers to capture these cookies by intercepting their transmission within an http session.
Vulnerability class: Information Disclosure
EPSS: 0.013 (67.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Cisco Dpc3939
- Cisco Dpc3939b
- Cisco Dpc3939b_firmware — versions dpc3939b-v303r204217-150321a-cmcst
- Cisco Dpc3939_firmware — versions dpc3939-p20-18-v303r20421733-160420a-cmcst, dpc3939-p20-18-v303r20421746-170221a-cmcst
- Cisco Dpc3941t
- Cisco Dpc3941t_firmware — versions dpc3941_2.5s3_prod_sey
- Commscope Arris_tg1682g
- Commscope Arris_tg1682g_firmware — versions 10.0.132.sip.pc20.ct, tg1682_2.2p7s2_prod_sey
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Third Party Advisory, x_refsource_MISC, Mitigation)
Frequently asked questions
- What is CVE-2017-9491?
- CVE-2017-9491 is a medium-severity vulnerability in Cisco Dpc3939, classified under Information Disclosure. CVSS score: 5.3/10. Published 2017-07-31.
- How severe is CVE-2017-9491?
- Medium severity. CVSS v3 base score is 5.3 out of 10.