Cisco Scientific Atlanta D20 and D30 Based Cable Modem Cross-Site Scripting Vulnerability
Cisco-SA-20120613-CVE-2012-3047 · Medium · Published · Updated
Cisco Scientific Atlanta cable modems (D20 and D30 based products) contain a vulnerability that could allow an unauthenticated, remote attacker to conduct cross-site scripting attacks. The vulnerability is due to insufficient sanitization of user-supplied input to the web wizard setup web page. An unauthenticated, remote attacker could exploit this vulnerability by convincing a user to visit a website that is designed to submit a crafted HTTP POST request to the web interface of the affected product. If the user visits the malicious page, the attacker could execute arbitrary script code in the user's browser with the security context of the affected site. Proof-of-concept code is publicly available. Cisco has confirmed this vulnerability, and updates will be made available to service providers. Cisco PSIRT reports that the vulnerability was first identified on an end-of-life (EOL) product, the DPR2320R2 Gateway. There is no fix planned for this EOL product. Newer-generation DOCSIS 2.0 products will have fixes made available through future releases. A fix for all DOCSIS 3.0 CPE based products will be in the next GA release. Updates are not available to end users; updates will be made available to service providers for deployment to their end users at their discretion. To exploit the vulnerability, the attacker may provide a link via e-mail, instant messaging, or another form of communication that directs a user to a malicious site and use misleading language or instructions to persuade the user to follow the provided link. Cisco would like to thank Marcos M. Garcia (@artsweb) for discovering this vulnerability.
Workarounds
Administrators are advised to contact the vendor regarding future updates and releases.
Users are advised not to open e-mail messages from suspicious or unrecognized sources. If users cannot verify that links or attachments included in e-mail messages are safe, they are advised not to open them.
The Cisco Applied Intelligence team has created the following companion document to guide administrators in identifying and mitigating attempts to exploit this vulnerability prior to applying updated software:
Understanding Cross-Site Scripting (XSS) Threat Vectorshttp://tools.cisco.com/security/center/content/CiscoAppliedMitigationBulletin/cisco-amb-20060922-understanding-xss
Users should verify that unsolicited links are safe to follow.
Administrators are advised to monitor affected systems.
| CVEs | CVE-2012-3047 |
|---|---|
| Cisco Bug IDs | NA |
| CVSS Score | Base 4.3 Base 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N/E:POC/RL:U/RC:C/CDP:N/TD:N/CR:ND/IR:ND/AR:ND |
| Product Names From Source | Cisco Scientific Atlanta WebSTAR Cable Modem |
Related Products
| Product | CVE | Evidence |
|---|