Security readout for executives and security teams
Plain-English summary
This CVE describes a CSRF weakness in Comcast firmware for Arris TG1682G gateway devices. A user with access to the device's management context could be tricked into causing configuration changes. The public record does not provide a severity score, patch status, or evidence of active exploitation.
Executive priority
Treat this as a targeted device-risk review, not an emergency based on current evidence. Prioritize confirming whether affected Comcast-managed gateways exist, then seek vendor or ISP remediation guidance because the public CVE data lacks severity and patch detail.
Technical view
CVE-2017-9490 covers configuration changes via cross-site request forgery on Arris TG1682G devices running Comcast firmware eMTA/DOCSIS 10.0.132.SIP.PC20.CT and software TG1682_2.2p7s2_PROD_sey. The source bundle does not list CVSS, CWE, detailed affected CPEs, or vendor remediation.
Likely exposure
Exposure appears limited to environments using the specifically named Arris TG1682G Comcast firmware versions. The structured affected-product fields are incomplete, so teams should confirm device model, firmware, and ownership through asset records or ISP support.
Exploitation context
The bundle cites a Bastille Research advisory and the CVE record. CISA KEV is false, and the provided sources do not state known active exploitation. The available description is high level and does not establish internet-wide exploitability.
Researcher notes
The record is sparse: no CVSS, CWE, CPE list, or confirmed fix is provided in the bundle. The description identifies a specific device and firmware build, but structured affected fields are marked n/a, so validation should rely on exact firmware evidence.
Mitigation direction
- Check Comcast or Arris guidance for firmware updates, replacement, or support status.
- Confirm whether the affected gateway remains deployed in your environment.
- Limit administrative access to trusted users and networks where configuration permits.
- Avoid leaving authenticated gateway management sessions active during general browsing.
- Replace unsupported affected devices if no supported firmware path exists.
Validation and detection
- Inventory Arris TG1682G devices and record exact firmware and software versions.
- Compare versions against the CVE description before treating a device as affected.
- Review gateway configuration history for unauthorized or unexpected changes.
- Check whether device administration is reachable from untrusted network segments.
- Document vendor or ISP confirmation on patch, replacement, or non-applicability.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9490 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-33.cross-site-request-forgery.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.