CVE-2017-11502
📋 TL;DR
This vulnerability allows remote attackers to read arbitrary files on Technicolor DPC3928AD DOCSIS cable modems by sending specially crafted HTTP GET requests to port 4321. The attack exploits a directory traversal flaw that doesn't require authentication, affecting all users of these devices with default configurations.
💻 Affected Systems
- Technicolor DPC3928AD DOCSIS cable modem
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the device including extraction of sensitive configuration files, credentials, and potentially enabling further attacks on the local network.
Likely Case
Unauthorized access to device configuration files, potentially exposing network credentials and sensitive information.
If Mitigated
Limited impact if device is behind NAT/firewall with restricted access to port 4321.
🎯 Exploit Status
Simple HTTP GET request with directory traversal sequence is sufficient for exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Specific firmware version not publicly documented, but Technicolor released patches
Vendor Advisory: No public vendor advisory URL available
Restart Required: Yes
Instructions:
1. Contact ISP for firmware update 2. Apply latest firmware from ISP 3. Reboot device after update
🔧 Temporary Workarounds
Block port 4321
linuxPrevent external access to the vulnerable service port
iptables -A INPUT -p tcp --dport 4321 -j DROP
Disable web management interface
allTurn off the vulnerable web interface if not needed
🧯 If You Can't Patch
- Isolate device on separate VLAN with strict access controls
- Implement network segmentation to limit lateral movement
🔍 How to Verify
Check if Vulnerable:
Test with curl: curl -v 'http://[device_ip]:4321/../etc/passwd' and check for file contents in responseCheck Version:
Check web interface or contact ISP for firmware versionVerify Fix Applied:
Retest with same curl command - should return error or no file contents📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '/../' patterns on port 4321
- Unusual file access patterns from external IPs
Network Indicators:
- HTTP GET requests to port 4321 with directory traversal sequences
- Traffic to device management port from unauthorized sources
SIEM Query:
source_port:4321 AND (http_uri:"/../" OR http_uri:"..")