TWSL2011-002: Vulnerabilities in Comcast DOCSIS 3.0 Business Gateways (SMCD3G-CCR)

The SpiderLabs team at Trustwave published a new advisory yesterday, which details three vulnerabilities in the Comcast DOCSIS 3.0 Business Gateways (SMCD3G-CCR). The Comcast DOCSIS 3.0 Business Gateway provides end-user termination of cable internet services for Comcast Business Class customers with enhanced services including Network Address Translation (NAT), firewalling, and Virtual Private Network (VPN) termination.

In total, three vulnerabilities were disclosed. The first is the prevalence of a hard-coded root-level username and password on all SMCD3G-CCR devices. This account provides full access to any device which has not been updated. The second issue is a cross-site request forgery vulnerability on the management interface of all SMCD3G-CCR gateways. Refer to the full advisory for a proof-of-concept which demonstrates how a malicious user can access, log-in, and modify the DNS information on an end-user's network. The third vulnerability disclosed weak session management, which allowed a malicious user to brute force the session key for a logged-in administrative user.