our cable modems (regardless of brand, be it 3com, Ambit, Toshiba...etc) have a 10.x.x.x IP address that is not accessable to the public. Only if you have direct access to the CMTS system can you upload new BIN configuration files to these modems on the fly.
Well, I hope you don't use Motorola SB3100 or SB4100 modems, since they have a documented ARP poisoning attack that causes the modem to TFTP its config from the local Ethernet segment instead of the headend.