Read the docs
TI-2017-06927 Aliases CVE-2017-9521GHSA-7rpj-hpvp-vvv6

The Comcast firmware on Cisco DPC3939 (firmware version…

Priority MEDIUM 48Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

The Comcast firmware on Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421733-160420a-CMCST); Cisco DPC3939 (firmware version dpc3939-P20-18-v303r20421746-170221a-CMCST); Cisco DPC3939B (firmware version dpc3939b-v303r204217-150321a-CMCST); Cisco DPC3941T (firmware version DPC3941_2.5s3_PROD_sey); and Arris TG1682G (eMTA&DOCSIS version 10.0.132.SIP.PC20.CT, software version TG1682_2.2p7s2_PROD_sey) devices allows remote attackers to execute arbitrary code via a specific (but unstated) exposed service. NOTE: the scope of this CVE does NOT include the concept of "Unnecessary Services" in general; the scope is only a single service that is unnecessarily exposed, leading to remote code execution. The details of that service might be disclosed at a later date.

Why it matters now

EPSS 0.03262 88th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:cisco:dpc3939_firmware:dpc3939-p20-18-v303r20421733-160420a-cmcst:*:*:*:*:*:*:*dpc3939-p20-18-v303r20421733-160420a-cmcstVulnerableCisco
cpe:2.3:h:cisco:dpc3939:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:dpc3939_firmware:dpc3939-p20-18-v303r20421746-170221a-cmcst:*:*:*:*:*:*:*dpc3939-p20-18-v303r20421746-170221a-cmcstVulnerableCisco
cpe:2.3:o:cisco:dpc3939b_firmware:dpc3939b-v303r204217-150321a-cmcst:*:*:*:*:*:*:*dpc3939b-v303r204217-150321a-cmcstVulnerableCisco
cpe:2.3:h:cisco:dpc3939b:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:cisco:dpc3941t_firmware:dpc3941_2.5s3_prod_sey:*:*:*:*:*:*:*dpc3941_2.5s3_prod_seyVulnerableCisco
cpe:2.3:h:cisco:dpc3941t:-:*:*:*:*:*:*:*not specified by NVDRunning onCisco
cpe:2.3:o:commscope:arris_tg1682g_firmware:10.0.132.sip.pc20.ct:*:*:*:*:*:*:*10.0.132.sip.pc20.ctVulnerableCommScope, Inc.
cpe:2.3:o:commscope:arris_tg1682g_firmware:tg1682_2.2p7s2_prod_sey:*:*:*:*:*:*:*tg1682_2.2p7s2_prod_seyVulnerableCommScope, Inc.
cpe:2.3:h:commscope:arris_tg1682g:-:*:*:*:*:*:*:*not specified by NVDRunning onCommScope, Inc.
  • cpe:2.3:o:cisco:dpc3939_firmware:dpc3939-p20-18-v303r20421733-160420a-cmcst:*:*:*:*:*:*:* Versions dpc3939-p20-18-v303r20421733-160420a-cmcst Vulnerable ·Cisco
  • cpe:2.3:h:cisco:dpc3939:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:dpc3939_firmware:dpc3939-p20-18-v303r20421746-170221a-cmcst:*:*:*:*:*:*:* Versions dpc3939-p20-18-v303r20421746-170221a-cmcst Vulnerable ·Cisco
  • cpe:2.3:o:cisco:dpc3939b_firmware:dpc3939b-v303r204217-150321a-cmcst:*:*:*:*:*:*:* Versions dpc3939b-v303r204217-150321a-cmcst Vulnerable ·Cisco
  • cpe:2.3:h:cisco:dpc3939b:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:cisco:dpc3941t_firmware:dpc3941_2.5s3_prod_sey:*:*:*:*:*:*:* Versions dpc3941_2.5s3_prod_sey Vulnerable ·Cisco
  • cpe:2.3:h:cisco:dpc3941t:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Cisco
  • cpe:2.3:o:commscope:arris_tg1682g_firmware:10.0.132.sip.pc20.ct:*:*:*:*:*:*:* Versions 10.0.132.sip.pc20.ct Vulnerable ·CommScope, Inc.
  • cpe:2.3:o:commscope:arris_tg1682g_firmware:tg1682_2.2p7s2_prod_sey:*:*:*:*:*:*:* Versions tg1682_2.2p7s2_prod_sey Vulnerable ·CommScope, Inc.
  • cpe:2.3:h:commscope:arris_tg1682g:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·CommScope, Inc.

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-9521
  2. 2026-10-03 Alias added: GHSA-7rpj-hpvp-vvv6

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences