Where
-Infinity
0
Severity
5.3
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

The Comcast firmware on Motorola MX011ANM (firmware version MX011AN2.9p6s1PRODsey) devices allows remote attackers to enable a Remote Web Inspector that is accessible from the public Internet.

First published (updated )
Severity
4.6
Infoleak
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

The Comcast firmware on Motorola MX011ANM (firmware version MX011AN2.9p6s1PRODsey) devices allows physically proximate attackers to read arbitrary files by pressing "EXIT, Down, Down, 2" on an RF4CE remote to reach the diagnostic display, and then launching a Remote Web Inspector script.

First published (updated )
Severity
5.5
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

The Comcast firmware on Motorola MX011ANM (firmware version MX011AN2.9p6s1PRODsey) and Xfinity XR11-20 Voice Remote devices allows local users to upload arbitrary firmware images to an XR11 by leveraging root access. In other words, there is no protection mechanism involving digital signatures for the firmware.

First published (updated )
Severity
7.2
Input Validation
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Comcast firmware on Motorola MX011ANM (firmware version MX011AN2.9p6s1PRODsey) devices allows physically proximate attackers to execute arbitrary commands as root by pulling up the diagnostics menu on the set-top box, and then posting to a Web Inspector route.

First published (updated )
Severity
6.3
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

The Comcast firmware on Motorola MX011ANM (firmware version MX011AN2.9p6s1PRODsey) devices allows remote attackers to conduct successful forced-pairing attacks (between an RF4CE remote and a set-top box) by repeatedly transmitting the same pairing code.

First published (updated )
Severity
6.8
CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

The Comcast firmware on Motorola MX011ANM (firmware version MX011AN2.9p6s1PRODsey) devices allows physically proximate attackers to access an SNMP server by connecting a cable to the Ethernet port, and then establishing communication with the device's link-local IPv6 address.

First published (updated )

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203