COX FIXED AN API AUTH BYPASS EXPOSING MILLIONS OF MODEMS TO ATTACKS

Summary from the TLDR InfoSec newsletter

Bug bounty hunter Sam Curry discovered an API authentication bypass in Cox Communications' systems that could give attackers the same permissions as a tech support agent for the ISP. Attackers could use the bypass to obtain the PII of customers, reset modems, or gather WiFi information. Cox took the 700 exposed API endpoints down within hours of the report and fixed the issue the following day. It has found no evidence of exploitation.