CVE-2011-0887

2011-02-0822:00:02

CWE-310

mitre

web.nvd.nist.gov

cve-2011-0887

smc

smcd3g-ccr

comcast business gateway

session hijacking

predictable session ids

firmware vulnerability

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

AI Score

6.7

Confidence

Low

EPSS

0.013

Percentile

86.1%

JSON

The web management portal on the SMC SMCD3G-CCR (aka Comcast Business Gateway) with firmware before 1.4.0.49.2 uses predictable session IDs based on time values, which makes it easier for remote attackers to hijack sessions via a brute-force attack on the userid cookie.

Affected configurations

Nvd

Node

smc_networkssmcd3g-ccr

AND

smc_networkssmcd3g-ccr_firmwareMatch1.4.0.42

VendorProductVersionCPE
smc_networkssmcd3g-ccr*cpe:2.3:h:smc_networks:smcd3g-ccr:*:*:*:*:*:*:*:*
smc_networkssmcd3g-ccr_firmware1.4.0.42cpe:2.3:a:smc_networks:smcd3g-ccr_firmware:1.4.0.42:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
smc_networks	smcd3g-ccr	*	cpe:2.3:h:smc_networks:smcd3g-ccr::::::::
smc_networks	smcd3g-ccr_firmware	1.4.0.42	cpe:2.3:a:smc_networks:smcd3g-ccr_firmware:1.4.0.42:::::::*