CVE-2017-11502

published 2017-07-20

CVE-2017-11502: Technicolor DPC3928AD DOCSIS devices allow remote attackers to read arbitrary files via a request starting with "GET /../" on TCP port 4321.

Priority P2 65 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

Technicolor DPC3928AD DOCSIS devices allow remote attackers to read arbitrary files via a request starting with "GET /../" on TCP port 4321.

Detection & IOCs extracted from sources · hover to see the quote

port TCP/4321↗

command GET /../../../../../../../../../../../../../../../../etc/passwd HTTP/1.1↗

path /../../../../../../../../../../../../../../../../etc/passwd↗

• → Detect path traversal attempts targeting TCP port 4321 — look for HTTP GET requests containing sequences of '/../' directed at this port, which is the UPnP/management service on affected Technicolor/Cisco DPC3928AD devices. ↗
• → The server banner 'SERVER: Linux/#2 Wed Nov 12 10:23:46 CST 2014 UPnP/1.0 Broadcom UPNP/0.9' in HTTP responses on port 4321 can fingerprint vulnerable devices for targeted exploitation. ↗
• → Monitor HTTP responses on port 4321 for passwd-file content patterns (e.g., lines matching 'root:.*:0:0:' or '/bin/sh') which would indicate successful arbitrary file disclosure exploitation. ↗

• · The vulnerability is present on the UPnP/management service listening on TCP port 4321. This port may be accessible from the LAN side; exposure depends on ISP/device network configuration. No patch will be issued as the product is end-of-life. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200