Security readout for executives and security teams
Plain-English summary
This flaw affects a specific Comcast firmware build on Cisco DPC3939 gateways. An attacker already on the local network could abuse the syseventd service to run commands as root, which is full device control. The source bundle does not confirm active exploitation, a CVSS score, or a vendor fix.
Executive priority
Treat as high priority for environments that still depend on affected gateways, especially shared offices, guest networks, or managed residential deployments. The local-access requirement lowers broad internet risk but does not reduce impact if an attacker reaches the LAN.
Technical view
CVE-2017-9479 is local-network reachable command execution in Comcast firmware dpc3939-P20-18-v303r20421746-170221a-CMCST on Cisco DPC3939 devices. The described path is connecting to the syseventd server and executing arbitrary commands as root. Public affected-product metadata in the bundle is incomplete.
Likely exposure
Exposure is likely limited to networks still using Cisco DPC3939 devices with the named Comcast firmware build. The attacker must have local network access, so guest Wi-Fi, compromised internal hosts, or shared residential networks matter most.
Exploitation context
The CVE description reports root command execution from local network access. The bundle’s KEV flag is false, and no cited source states active exploitation in the wild. Evidence is insufficient to assess exploit maturity beyond the public advisory reference.
Researcher notes
The public data names one precise Comcast firmware build and describes root command execution through syseventd. NVD-style affected CPE, CVSS, CWE, patch status, and exploitation evidence are absent from the provided bundle, so conclusions should stay narrow.
Mitigation direction
- Inventory Cisco DPC3939 gateways and record exact firmware versions.
- Check Comcast, Cisco, or ISP guidance for fixed firmware or replacement options.
- Remove or replace affected gateways where supported updates are unavailable.
- Restrict untrusted LAN and guest Wi-Fi access to gateway services.
- Monitor for unexpected local connections to management or event services.
Validation and detection
- Verify whether any DPC3939 devices run the named Comcast firmware build.
- Confirm syseventd is not reachable from untrusted LAN segments.
- Review gateway administration and network logs for unusual local access.
- Check asset records for ISP-managed gateways outside normal patch control.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9479 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-22.syseventd.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.