Vulnerability Report

CVE-2017-9498

Title: Motorola Mx011Anm Path Traversal / LFI

Arbitrary File Access

Proof Of Concept

No public PoC currently indexed for CVE-2017-9498.

CWE Category CWE-354

Published Date Jul 31, 2017

Modified Date Jun 17, 2026

Exploit Status Not Found

Score 5.5 CVSS v3.0

Exploit Probability (EPSS)

0.19%

Vulnerability Summary

CVE-2017-9498: The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) and Xfinity XR11-20 Voice Remote devices allows local users to upload arbitrary firmware images to an XR11 by leveraging root access. In other words, there is no protection mechanism involving digital signatures for the firmware.

Impacted Vendors

motorola 1

comcast 1

Reference Links

https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-42.remote-OTA.txt https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-42.remote-OTA.txt

CVSS v3.0

Source Entity [email protected]

Severity MEDIUM

5.5

Attack Vector

LOCAL

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CVSS v2.0

Source Entity [email protected]

Severity LOW

2.1

Access Vector

N/A

Authentication

N/A

RAW VECTOR AV:L/AC:L/Au:N/C:N/I:P/A:N

Associated Attack Patterns (CAPEC)

Total: Patterns