CVE-2019-19495 - The web interface on the Technicolor TC7230 STEB 01.25 is vulnerable to DNS rebinding, which allows a remote attacker to configure the cable modem via JavaScript in a victim's browser

Back Back to CVE browser

CRITICAL

The web interface on the Technicolor TC7230 STEB 01.25 is vulnerable to DNS rebinding, which allows a remote attacker to configure the cable modem via JavaScript in a victim's browser

Published Jan 8, 2020

9.8

CRITICAL

CVSS 3.1

EPSS 4.29%

Description

The web interface on the Technicolor TC7230 STEB 01.25 is vulnerable to DNS rebinding, which allows a remote attacker to configure the cable modem via JavaScript in a victim's browser. The attacker can then configure the cable modem to port forward the modem's internal TELNET server, allowing external access to a root shell.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-20

Improper Input Validation

References (4)

https://cablehaunt.com
x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9115
Advisory
https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf
x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/Lyrebirds/Fast8690-exploit
x_refsource_MISCThird Party Advisory

Link	Providers	Tags
https://cablehaunt.com		x_refsource_MISCThird Party Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9115		Advisory
https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf		x_refsource_MISCExploitIssue TrackingThird Party Advisory
https://github.com/Lyrebirds/Fast8690-exploit		x_refsource_MISCThird Party Advisory