CVE-2017-16836 describes an unauthenticated stored Cross-Site Scripting (XSS) vulnerability in Arris TG1682G devices running Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT firmware, specifically within the actionHandler/ajax_managed_services.php service parameter. Rated Medium severity (CVSS 6.1), this flaw allows remote attackers to inject malicious scripts into affected devices, potentially leading to information disclosure or defacement with low attack complexity and requiring user interaction. While not listed in CISA's KEV catalog, public exploit code exists on ExploitDB, though there is no evidence of active exploitation or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
10.0.59.sip.pc20.ctCPE matchmatch criteria | cpe:2.3:o:commscope:arris_tg1682g_firmware:10.0.59.sip.pc20.ct:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.