A bug in Comcast's website used to activate Xfinity compromised sensitive information on the company's customers.
The website, used by customers to set up their home internet and cable service, was used to trick into displaying the home address where the router is located, as well as the Wi-Fi name and password.
Only a customer account ID and that customer's house or apartment number are needed, even though the web form asks for a full address.
That information could be grabbed from a discarded bill or obtained from an email.
The bug returns data even if the Xfinity Wi-Fi is already switched on.
It's also possible to rename Wi-Fi network names and passwords, temporarily locking users out.
Source: https://www.zdnet.com/article/comcast-bug-leaks-xfinity-home-addresses-wireless-passwords/
"id": "COM12229722",
"linkid": "comcast",
"type": "Data Leak",
"date": "05/2018",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"