PT-2014-8517 · Arris · Arris Vap2500

Headlesszeke · Publicado 2014-11-25 · Atualizado 2014-11-28 · CVE-2014-8423

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ARRIS VAP2500 versions prior to FW08.41

Description The issue concerns an unspecified vulnerability in the management portal of the ARRIS VAP2500. This vulnerability allows remote attackers to execute arbitrary commands. The exact vectors used for the attack are not specified.

Recommendations For ARRIS VAP2500 versions prior to FW08.41, update the firmware to FW08.41 or later to resolve the issue. As a temporary workaround, consider restricting access to the management portal to minimize the risk of exploitation.

Exploit

Correção

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2014-8423

ZDI-14-389

Produtos afetados

Arris Vap2500

Referências · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vap2500_tools_command_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/35372 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-14-389 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2014-8423 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-14-389 · Nota