First, access to the vulnerable endpoint is gained through a client on the local network, such as a browser. Secondly the vulnerable endpoint is hit with a buffer overflow attack, which gives the attacker control of the modem. Once attackers gain control of the modem, they could abuse it in multiple ways:
DNS: Attackers could change the default DNS server, allowing them to eavesdrop on all traffic.
MiTM: Man-in-the-middle attacks could be launched against modem users.
Flash: Attackers could swap out or flash the firmware on devices, as well as disable ISP upgrades.
Configure: Every configuration file or setting could be altered.
SNMP: Attackers could alter simple network management protocol information, which is used to monitor device performance and status.
MAC: All MAC addresses associated with the modem could be changed.
Serial numbers: Attackers could alter serial numbers.
Zombie: Vulnerable devices could be pressed into service as “zombie” nodes in a botnet.
Even if your modem is not in the list below, it could still be vulnerable. Many other modems are also vulnerable other than the ones mentioned below.
Only Five ISPs have reportedly patched all vulnerable devices they’ve issued to customers:
Given below is a Github vulnerability test that can be used by network administrators and cable modem users to evaluate whether their device is at risk.