CVE-2019-19495

An attacker uses DNS rebinding to bypass the browser's same-origin policy. The attacker lures a victim to visit a malicious website; the website's DNS name initially resolves to the attacker's server, then later resolves to the modem's internal IP (e.g., 192.168.0.1). The victim's browser then sends a crafted WebSocket request to the modem's Spectrum Analyzer endpoint. This request overflows a buffer on the stack, overwrites the return address, and executes a ROP chain that opens a listening TCP port (1337) on the modem. The attacker then connects to that port and sends a MIPS binary payload that provides an interactive root shell via the modem's eCos shell [ref_id=1].

The advisory does not specify exact source files or functions. The vulnerable component is the Spectrum Analyzer web interface of the Technicolor TC7230 cable modem running firmware STEB 01.25 [ref_id=1]. The bug is a buffer overflow triggered via WebSocket requests sent to the modem's internal web server.

No patch is provided in the bundle. The advisory notes that firmware version 50.10.21 or newer on related modems should be secure against the Cable Haunt vulnerability [ref_id=1]. The recommended remediation is to update the modem firmware to a version that properly validates WebSocket frame boundaries and enforces origin checks, preventing the buffer overflow in the Spectrum Analyzer component.