CVE-2017-9492

CVE-2017-9492 describes a vulnerability in Comcast firmware for specific Cisco DPC3939, DPC3939B, DPC3941T, and Arris TG1682G devices. The flaw stems from the absence of the HTTPOnly flag in Set-Cookie headers for administrative applications. This omission allows remote attackers to access potentially sensitive information through script-based cookie theft. The vulnerability has a CVSS score of 7.5 (HIGH), indicating a network-based attack with low complexity and high confidentiality impact. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.