Quantum Secular Labs / Blog / Advisories
CVE-2017-5135: Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in…
CVE-2017-5135 is rated critical with a CVSS v3.0 base score of 9.1 and NVD lists Technicolor Dpc3928sl Firmware as the affected product. Per its scoring, it can be exploited over the network, without authentication, without any user interaction.
Vulnerability description
Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases. The Technicolor (formerly Cisco) DPC3928SL with firmware D3928SL-P15-13-A386-c3420r55105-160127a could be reached by any SNMP community string from the Internet; also, you can write in the MIB because it provides write properties, aka Stringbleed. NOTE: the string-bleed/StringBleed-CVE-2017-5135 GitHub repository is not a valid reference as of 2017-04-27; it contains Trojan horse code purported to exploit this vulnerability.
Severity breakdown
CVSS v3.0 9.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
- Attack complexity: Low. No special conditions; the attack can be repeated reliably.
- Privileges required: None. No account or prior access is needed.
- User interaction: None. No action from any user is needed.
- Scope: Unchanged. Impact stays within the vulnerable component.
- Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
- Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
- Availability impact: None. No effect on availability.
Affected products
- Technicolor Dpc3928sl Firmware: d3928sl-p15-13-a386-c3420r55105-160127a