Security readout for executives and security teams
Plain-English summary
This issue affects Comcast firmware on Motorola MX011ANM set-top boxes running firmware MX011AN_2.9p6s1_PROD_sey. A nearby person with physical access could reach a diagnostics interface and trigger root-level command execution. Business risk is mainly where these boxes are deployed in accessible locations.
Executive priority
Prioritize if affected set-top boxes are deployed in locations where outsiders can touch them. For controlled back-office or retired equipment, urgency is lower. Lack of patch details means vendor confirmation is needed before closure.
Technical view
The CVE describes arbitrary command execution as root through a diagnostics-menu path followed by a Web Inspector route. The source bundle does not provide CVSS, CWE, patch status, or broad affected-version data beyond one firmware build on Motorola MX011ANM devices.
Likely exposure
Exposure appears limited to Motorola MX011ANM set-top boxes with the named Comcast firmware, especially units in public, customer-facing, or shared physical environments. Evidence does not support generalizing to other Motorola or Comcast devices.
Exploitation context
The CVE requires physical proximity according to the description. It is not listed as CISA KEV in the provided bundle, and no cited source states active exploitation. Treat exploitation status as unconfirmed.
Researcher notes
The source record is sparse: no CVSS vector, CWE, fix version, or expanded product matrix is supplied. The key technical claim is root command execution via diagnostics access and Web Inspector routing. Avoid assuming remote exploitability or broader firmware impact.
Mitigation direction
- Inventory Motorola MX011ANM devices and record firmware versions.
- Restrict physical access to deployed set-top boxes.
- Ask Comcast or vendor support for firmware updates or replacement guidance.
- Remove, replace, or isolate affected units where access cannot be controlled.
Validation and detection
- Confirm whether MX011ANM devices are present in the environment.
- Compare firmware against MX011AN_2.9p6s1_PROD_sey.
- Review deployment locations for public or shared physical access.
- Document vendor guidance and remediation decisions for each affected unit.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2017-9497 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/BastilleResearch/CableTap/blob/master/doc/advisories/bastille-41.root-command-execution.txtCVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.