Cisco fixes critical flaw in modems and wireless gateways

A number of Cisco home network gateways have a security bug that allows attackers to hijack the devices remotely. Today the company released to ISPs a firmware update to patch the flaw. Users with direct Cisco service contracts can obtain the patched software versions directly from the company's website and those without such contracts should contact the Cisco Technical Assistance Center.

"The vulnerability is due to incorrect input validation for HTTP requests," Cisco explained in an advisory published on Wednesday. "An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. Successful exploitation could allow the attacker to crash the web server and execute arbitrary code with elevated privileges. This vulnerability exists whether the device is configured in Router mode or Gateway mode."

According to Cisco, the flaw is present on the devices whether they are operating as internet access gateways or as wireless routers on home or small office gateways. The affected devices are:

• Cisco DPC3212 VoIP Cable Modem
• Cisco DPC3825 8x4 DOCSIS 3.0 Wireless Residential Gateway
• Cisco EPC3212 VoIP Cable Modem
• Cisco EPC3825 8x4 DOCSIS 3.0 Wireless Residential Gateway
• Cisco Model DPC3010 DOCSIS 3.0 8x4 Cable Modem
• Cisco Model DPC3925 8x4 DOCSIS 3.0 with Wireless Residential Gateway with EDVA
• Cisco Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with EDVA
• Cisco Model EPC3010 DOCSIS 3.0 Cable Modem
• Cisco Model EPC3925 8x4 DOCSIS 3.0 with Wireless Residential Gateway with EDVA

Read more -here-

• Dropbox breach exposes customer credentials, authentication data
• Google: Passkey authentications top 1 billion across 400 million accounts
• FTC fines Razer for misrepresenting COVID masks as N95s
• FCC fines Verizon, AT&T other major carriers nearly $200 million for sharing customer data
• Federal regulators accuse Amazon executives of deleting messages
• FCC restores net neutrality rules