Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Thomson TCW690 Denial Of Service Vulnerability
From: MurDoK <murdok.lnx () gmail com>
Date: Sun, 20 Feb 2005 11:51:57 +0100

El Sábado, 19 de Febrero de 2005 17:57, Andres Tarasco escribió:

Yes, I saw that vulnerability but as securityfocus only says that cablemodems
affected were TCM 305 and TCM 315 I decided to send it too.

Seems to be the same vulnerability published time ago


On Sat, 19 Feb 2005 10:43:44 +0100, MurDoK <murdok.lnx () gmail com> wrote:
I found a vulnerability in this cablemodem which a malicious user inside
*LAN can reset it easily.
This cablemodem model is given by the spanish ISP "AUNA".


Product: Thomson TCW690 cablemodem
Affected Version: ST42.03.0a (possible others)
Immune Version: ???
Security-Risk: high
Exploit: yes
ory=cab%20modem%20Eurodocsis&model=TCW690 Vendor-URL:
Vendor-Status: informed but no response


The http server inside this cablemodem doesn't check the length of GET
requests. If you exploit this bug the router will become unstable for ~50


No code needed. Just open your browser to[about 2000 A's]AAA


No response from vendor. There isn't fix available.

Vendor Status
2005.02.07 - Bug found.
2005.02.07 - Informed the vendor broadband () thomson net, no response.
2005.02.11 - Informed the vendor webmaster () thomson net 
2005.02.19 - Public disclosure.
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]