Cisco Prime Home flaw allows hackers to reach into people's homes
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2017-3791 | A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with admin A vulnerability in the web-based GUI of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authentication and execute actions with administrator privileges. The vulnerability is due to a processing error in the role-based access control (RBAC) of URLs. An attacker could exploit this vulnerability by sending API commands via HTTP to a particular URL without prior authentication. An exploit could allow the attacker to perform any actions in Cisco Prime Home with administrator privileges. This vulnerability affects Cisco Prime Home versions from 6.3.0.0 to the first fixed release 6.5.0.1. Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability. Cisco Bug IDs: CSCvb49837. NVD description · AI analysis pending | 10.0 | 4% |
| — |
Full article318 words · extracted from helpnetsecurity.com · click to collapse
Cisco has patched a critical authentication bypass vulnerability that could allow attackers to completely take over Cisco Prime Home installations, and through them mess with subscribers’ home network and devices.
Cisco Prime Home is a cloud-based network management platform used by service providers to simplify the remote management and provisioning of subscribers’ home network and all TR-069-compliant in-home devices connected to it (residential gateways, IP set-top boxes, femtocells, IP phones, and so on).
It can also provide certain services to some non-TR-069 devices, such as PCs or smartphones, by proxy through the residential gateway.
Cisco Prime Home vulnerability details
The vulnerability (CVE-2017-3791), found internally by Cisco security testers, affects the platform’s web-based GUI, and can be exploited by remote attackers to bypass authentication and execute any action in Cisco Prime Home with administrator privileges.
No user interaction is needed for the exploit to work, and exploitation couldn’t be simpler: an attacker just needs to send API commands via HTTP to a particular URL.
Update as soon as possible
There is no indication that the flaw is being exploited in attacks in the wild. But, as there is no workaround for plugging the hole, service providers who have chosen to deploy the platform on their own network instead of hosting it with Cisco are urged to migrate to version 6.5.0.1 as soon as possible.
The bug exists in versions 6.4 and later of Cisco Prime Home, but does not affect versions 5.2 and earlier.
“Administrators can verify whether they are running an affected version by opening the Prime Home URL in their browser and checking the Version: line in the login window. If currently logged in, the version information can be viewed in the bottom left of the Prime Home GUI footer, next to the Cisco Prime Home text,” Cisco instructed in the security advisory.
Three months ago Cisco squashed a very similar bug in Cisco Prime Home.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2017/02/02/cisco-prime-home-flaw/