Cisco Patches Serious Flaws In Cable Modems and Home Gateways (csoonline.com)

itwbennett writes: Cisco Systems has patched high-impact vulnerabilities in several of its cable modem and residential gateway devices that are distributed by some ISPs to their customers, and said in an advisory that customers should contact their service providers to ensure they have the patches. The embedded Web server in the Cisco Cable Modem with Digital Voice models DPC2203 and EPC2203 contains a buffer overflow vulnerability that can be exploited remotely without authentication. And the Web-based administration interfaces of the Cisco DPC3941 Wireless Residential Gateway with Digital Voice and Cisco DPC3939B Wireless Residential Voice Gateway are affected by a vulnerability that could lead to information disclosure. In addition, the Cisco Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with EDVA is affected by a separate vulnerability, also triggered by malicious HTTP requests, that could lead to a denial-of-service condition.

Comments

That's funny...

[__aaclcg7560]

I thought Cisco sold off Linksys to Belkin.

Re:That's funny...

[Banana Slamma]

At least one of those modems (I checked the DPC2203) appears to date back to at least 2010. The sale of Linksys appears to have been completed in 2013.

Are those flawed modems...

[surfdaddy]

...some of the ones that the corrupt ISPs "rent" to users for like $10/month? What a bargain!

No longer needed?

[whoever57]

The NSA told Cisco that these back doors are no longer needed.

Re:No longer needed?

[rahvin112]

Funny, but these are probably be fixed because Cisco is absolutely being destroyed in the enterprise security publications for all the unfixed vulnerabilities including things that are 10 years old like SSL 2.0 still being enabled. They were absolutely destroyed in the press for unfixed vulnerabilities a couple weeks ago by IIRC CERT, I have a feeling it's starting to effect their sales and they are responding so they don't loose all sales.

Re:Patched, but were they being exploited?

[softnewsit]

Did you ever hear Cisco admitting their equipment was used in real attacks? That's a lawsuit waiting to happen

Re:stupid mods

[is7s]

i wished something like that would get out

U FAIL IT

[sexconker]

If you're using an ISP-provided modem, congratulations, U FAIL IT.

1: Buy a Surfboard.
2: Toss the ISP shit into the toilet, then call the ISP and tell them to come pick it up.

Re:U FAIL IT

[sexconker]

Obama Let Me Be Clear.wav

By "Surfboard" I mean the Motorola/Arris modem line. If you want to buy an actual surfboard, go for it.

Re:U FAIL IT

[antdude]

Where can we buy our own cable modems with EMATA for the landline phone services? And without using splitters (signals are bad enough here) to hog another power plug, making more heat and space, etc.

Re:U FAIL IT

[sexconker]

I believe I've seen them on Amazon.
Various versions of the Surfboards will support the VoIP-specific shit. I've read reviews saying shit like "model xyz is the same as xyw but xyw supports Comcast's VoIP". Can't tell you if it's true or not, as I don't use a landline (pots or voip or otherwise) and I don't have Comcast (I know they can be picky with modems though).

Re:Buffer Overflows -not being found during testin

[manu0601]

Probably because the vast majority of ISP's don't use publicly addressable IP's for the cable modem interface, ever. And if they do, they're idiots.

That still leaves room for CSRF attacks

Audit in progress?

[manu0601]

Cisco is patching a lot theses days. Did they start a code audit?