high7.5
CVE-2017-11587
On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.2…
Impact
On Cisco DDR2200 ADSL2+ Residential Gateway DDR2200B-NA-AnnexA-FCC-V00.00.03.45.4E and DDR2201v1 ADSL2+ Residential Gateway DDR2201v1-NA-AnnexA-FCC-V00.00.03.28.3 devices, there is directory traversal in the filename parameter to the /download.conf URI.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cisco | Residential Gateway Firmware | Versions ddr2200b-na-annexa-fcc-v00.00.03.45.4e, ddr2201v1-na-annexa-fcc-v00.00.03.28.3 |