Slashdot Mirror
Cisco Patches Serious Flaws In Cable Modems and Home Gateways (csoonline.com)
itwbennett writes: Cisco Systems has patched high-impact vulnerabilities in several of its cable modem and residential gateway devices that are distributed by some ISPs to their customers, and said in an advisory that customers should contact their service providers to ensure they have the patches. The embedded Web server in the Cisco Cable Modem with Digital Voice models DPC2203 and EPC2203 contains a buffer overflow vulnerability that can be exploited remotely without authentication. And the Web-based administration interfaces of the Cisco DPC3941 Wireless Residential Gateway with Digital Voice and Cisco DPC3939B Wireless Residential Voice Gateway are affected by a vulnerability that could lead to information disclosure. In addition, the Cisco Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with EDVA is affected by a separate vulnerability, also triggered by malicious HTTP requests, that could lead to a denial-of-service condition.
At least one of those modems (I checked the DPC2203) appears to date back to at least 2010. The sale of Linksys appears to have been completed in 2013.
Funny, but these are probably be fixed because Cisco is absolutely being destroyed in the enterprise security publications for all the unfixed vulnerabilities including things that are 10 years old like SSL 2.0 still being enabled. They were absolutely destroyed in the press for unfixed vulnerabilities a couple weeks ago by IIRC CERT, I have a feeling it's starting to effect their sales and they are responding so they don't loose all sales.
Obama Let Me Be Clear.wav
By "Surfboard" I mean the Motorola/Arris modem line. If you want to buy an actual surfboard, go for it.
Probably because the vast majority of ISP's don't use publicly addressable IP's for the cable modem interface, ever. And if they do, they're idiots.
That still leaves room for CSRF attacks