====================================================================

                             CERT-Renater

                 Note d'Information No. 2016/VULN103
_____________________________________________________________________

DATE                : 10/03/2016

HARDWARE PLATFORM(S): Cisco Wireless Residential Gateway.

OPERATING SYSTEM(S): Cisco Wireless Residential Gateway software.

======================================================================
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160309-rgid
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160309-cmdos
_____________________________________________________________________

Cisco Security Advisory:Cisco Wireless Residential Gateway Information 
Disclosure Vulnerability

Advisory ID: cisco-sa-20160309-rgid

Revision 1.0

Published: 2016 March 9 16:00 GMT
+---------------------------------------------------------------------

Summary
========

A vulnerability in the web-based administration interface of the Cisco
Wireless Residential Gateway could allow an unauthenticated, remote
attacker to access sensitive information on the affected device.

The vulnerability is caused by improper access restrictions implemented
on the affected device. An attacker could exploit this vulnerability by
sending a crafted HTTP request to the affected device.

Cisco has released software updates to its service provider customers
that address the vulnerability described in this advisory. Prior to
contacting Cisco TAC, customers are advised to contact their service
providers to confirm the software deployed by the service provider
includes the fix that addresses this vulnerability. Workarounds that
mitigate this vulnerability are not available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160309-rgid

_____________________________________________________________________

Cisco Security Advisory:Cisco Wireless Residential Gateway with EDVA 
Denial of Service Vulnerability

Advisory ID: cisco-sa-20160309-cmdos

Revision 1.0

Published: 2016 March 9 16:00 GMT
+---------------------------------------------------------------------

Summary
========

A vulnerability in the web-based administration interface of Cisco
Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with EDVA
could allow an unauthenticated, remote attacker to cause the device to
become unresponsive and restart, creating a denial of service (DoS)
condition.

The vulnerability is due to improper handling, processing, and
termination of HTTP requests. An attacker could exploit this
vulnerability by sending crafted HTTP requests to management-enabled
interfaces of an affected system.


Cisco has released software updates to its service provider customers
that address the vulnerability described in this advisory. Prior to
contacting Cisco TAC, customers are advised to contact their service
providers to confirm the software deployed by the service provider
includes the fix that addresses this vulnerability. Workarounds that
mitigate this vulnerability are not available.

This advisory is available at the following link:
http://tools.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20160309-cmdos

==========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================