Published: 27/04/2017 Updated: 03/10/2019

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 9.1 | Impact Score: 5.2 | Exploitability Score: 3.9

VMScore: 645

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization in some cases. The Technicolor (formerly Cisco) DPC3928SL with firmware D3928SL-P15-13-A386-c3420r55105-160127a could be reached by any SNMP community string from the Internet; also, you can write in the MIB because it provides write properties, aka Stringbleed. NOTE: the string-bleed/StringBleed-CVE-2017-5135 GitHub repository is not a valid reference as of 2017-04-27; it contains Trojan horse code purported to exploit this vulnerability.

Vulnerable Product	Search on Vulmon	Subscribe to Product
technicolor dpc3928sl_firmware d3928sl-p15-13-a386-c3420r55105-160127a

#!/usr/bin/python # -*- coding: utf-8 -*- # StringBleed - CVE-2017-5135 __author__ = ["Nixawk"] __funcs__ = [ 'generate_snmp_communitystr', 'generate_snmp_proto_payload', 'send_snmp_request', 'read_snmp_communitystr', 'read_snmp_varbindstr', 'snmp_login', 'snmp_stringbleed' ] import struct import uuid import socket ...

NVD-CWE-noinfo https://www.reddit.com/r/netsec/comments/67qt6u/cve_20175135_snmp_authentication_bypass/https://stringbleed.github.io/http://www.securityfocus.com/bid/98092 https://nvd.nist.gov https://www.exploit-db.com/exploits/43384/

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2017-5135

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect