Genieacs Mcp
Monthly
DNS rebinding in genieacs-mcp's Streamable HTTP transport (versions <= 0.3.1) allows a malicious website to route browser requests through loopback to the unauthenticated /mcp listener and invoke arbitrary GenieACS NBI operations against managed CPE devices. Affected deployments expose full read/write access to TR-069 device state - including firmware update tasks, parameter changes, device reboots, presets, and connection requests - to any attacker who can lure the server operator to a malicious web page. A proof-of-concept is documented in the GitHub security advisory (GHSA-cmwv-wf9p-p8wx); no CISA KEV listing is present, indicating targeted rather than widespread exploitation at time of analysis.
DNS rebinding in genieacs-mcp's Streamable HTTP transport (versions <= 0.3.1) allows a malicious website to route browser requests through loopback to the unauthenticated /mcp listener and invoke arbitrary GenieACS NBI operations against managed CPE devices. Affected deployments expose full read/write access to TR-069 device state - including firmware update tasks, parameter changes, device reboots, presets, and connection requests - to any attacker who can lure the server operator to a malicious web page. A proof-of-concept is documented in the GitHub security advisory (GHSA-cmwv-wf9p-p8wx); no CISA KEV listing is present, indicating targeted rather than widespread exploitation at time of analysis.