CVE-2017-9492 — The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices does not include the HTTPOnly flag in a Set-Cookie header for administration applications, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies

Back Back to CVE browser

HIGH

The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices does not include the HTTPOnly flag in a Set-Cookie header for administration applications, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies

Published Jul 31, 2017

7.5

HIGH

CVSS 3.1

EPSS 1.58%

Description

The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices does not include the HTTPOnly flag in a Set-Cookie header for administration applications, which makes it easier for remote attackers to obtain potentially sensitive information via script access to cookies.

Affected products

Remediation

No remediation recorded yet.

Metrics

1.58% 0.01581

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.01581

Score over time

2021–2026

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Percentile over time

EPSS v1
EPSS v2
EPSS v3
EPSS v5

Table of values (14 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	1.58% (0.01581)	74.62th	v5 (v2026.06.15)
Jun 15, 2026	1.58% (0.01581)	72.25th	v5 (v2026.06.15)
Jul 20, 2024	0.25% (0.00253)	65.54th	v3 (v2023.03.01)
Apr 12, 2024	0.25% (0.00249)	64.41th	v3 (v2023.03.01)
Feb 8, 2024	0.25% (0.00254)	64.36th	v3 (v2023.03.01)
Mar 7, 2023	0.25% (0.00254)	61.52th	v3 (v2023.03.01)
Mar 6, 2023	1.05% (0.01055)	52.13th	v2 (v2022.01.01)
Sep 17, 2022	1.05% (0.01055)	50.47th	v2 (v2022.01.01)
Apr 1, 2022	1.05% (0.01055)	48.43th	v2 (v2022.01.01)
Feb 4, 2022	1.05% (0.01055)	27.52th	v2 (v2022.01.01)
Feb 3, 2022	0.52% (0.00523)	12.55th	v1
Jan 6, 2022	0.52% (0.00523)	12.10th	v1
Sep 1, 2021	0.52% (0.00523)	32.27th	v1
Apr 14, 2021	0.52% (0.00523)	0.00th	v1

Weaknesses (1)

CWE-200

Exposure of Sensitive Information

References (1)

https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-35.improper-cookie-flags.txt
x_refsource_MISCMitigationThird Party Advisory

Link	Providers	Tags
https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-35.improper-cookie-flags.txt		x_refsource_MISCMitigationThird Party Advisory