Customers without service contracts should request free upgrades through the Cisco Technical Assistance Center (contact information can be found here).
The vulnerability, which was awarded the maximum severity score even though there isn't evidence it is currently being used in attacks, "could allow an unauthenticated, remote attacker to exploit a buffer overflow and cause arbitrary code execution."
"The vulnerability is due to incorrect input validation for HTTP requests," Cisco explained in an advisory published on Wednesday.
"An attacker could exploit this vulnerability by sending a crafted HTTP request to the affected device. Successful exploitation could allow the attacker to crash the web server and execute arbitrary code with elevated privileges. This vulnerability exists whether the device is configured in Router mode or Gateway mode."
There is no workaround for the flaw - updating the software is the only way to remove the risk that the vulnerability poses.
Affected products are:
- Cisco DPC3212 VoIP Cable Modem
- Cisco DPC3825 8x4 DOCSIS 3.0 Wireless Residential Gateway
- Cisco EPC3212 VoIP Cable Modem
- Cisco EPC3825 8x4 DOCSIS 3.0 Wireless Residential Gateway
- Cisco Model DPC3010 DOCSIS 3.0 8x4 Cable Modem
- Cisco Model DPC3925 8x4 DOCSIS 3.0 with Wireless Residential Gateway with EDVA
- Cisco Model DPQ3925 8x4 DOCSIS 3.0 Wireless Residential Gateway with EDVA
- Cisco Model EPC3010 DOCSIS 3.0 Cable Modem
- Cisco Model EPC3925 8x4 DOCSIS 3.0 with Wireless Residential Gateway with EDVA.