SSD Advisory – Cisco DPC3928AD DOCSIS Wireless Router Information Disclosure

Vulnerability Summary
The following advisory describe information disclosure vulnerability in Cisco DPC3928AD DOCSIS wireless router. The Cisco DPC3928AD DOCSIS is a home wireless router that is currently “Out of support” but is provided by ISPs on a large scale in many countries.

Credit
An independent security researcher has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

Vulnerability details
The information disclosure vulnerability allows an attacker to gin the passwd file from the router, the vulnerable port is 4321.

The banner of the remote service is:

Proof of Concept

An attacker sending the following request:

Will receive from the server the following response:

Vendor Response
The vendor has responded with the following:
“I wanted to follow-up with you regarding your Cisco DPC3928AD DOCSIS disclosure. After an extensive search for the product to perform validation, we were unable to source the gateway to validate your proof of concept. Due to the end-of-sale and end-of-life of the product Technicolor will not be patching the bug. If you have any further questions or concerns please feel free to contact me, thank you.”