Cisco Wireless Residential Gateway Remote Code Execution Vulnerability

2014-07-1616:00:00

tools.cisco.com

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

0.011

Percentile

84.6%

JSON

A vulnerability in the web server used in multiple Cisco Wireless Residential Gateway products could allow an unauthenticated, remote attacker to exploit a buffer overflow and cause arbitrary code execution.

The vulnerability is due to incorrect input validation for HTTP requests. An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. Cisco has released software updates that address this vulnerability. Workarounds that mitigate this vulnerability are not available.

This advisory is available at the following link:

https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciscosa-20140716-cm[“https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/ciscosa-20140716-cm”]

Affected configurations

Vulners

Node

ciscodpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapterMatchany

ciscodpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapterMatch3.0_wireless_residential_gateway_with_edva

VendorProductVersionCPE
ciscodpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapteranycpe:2.3:a:cisco:dpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapter:any:*:*:*:*:*:*:*
ciscodpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapter3.0_wireless_residential_gateway_with_edvacpe:2.3:a:cisco:dpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapter:3.0_wireless_residential_gateway_with_edva:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
cisco	dpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapter	any	cpe:2.3:a:cisco:dpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapter:any:::::::*
cisco	dpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapter	3.0_wireless_residential_gateway_with_edva	cpe:2.3:a:cisco:dpq3925_8x4_docsis_3.0_wireless_residential_gateway_with_embedded_digital_voice_adapter:3.0_wireless_residential_gateway_with_edva:::::::*