PT-2015-7509 · Arris · Arris Tg862G+1

Bernardo Rodrigues · Publicado 2015-11-21 · Atualizado 2015-11-23 · CVE-2015-7291

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Arris DG860A versions TS0703128 100611 through TS0705125D 031115 Arris TG862A versions TS0703128 100611 through TS0705125D 031115 Arris TG862G versions TS0703128 100611 through TS0705125D 031115

Description A cross-site request forgery (CSRF) issue exists in the adv pwd cgi component of the web management interface, allowing remote attackers to hijack the authentication of arbitrary users.

Recommendations For Arris DG860A versions TS0703128 100611 through TS0705125D 031115, consider disabling access to the adv pwd cgi component in the web management interface until a fix is available. For Arris TG862A versions TS0703128 100611 through TS0705125D 031115, consider disabling access to the adv pwd cgi component in the web management interface until a fix is available. For Arris TG862G versions TS0703128 100611 through TS0705125D 031115, consider disabling access to the adv pwd cgi component in the web management interface until a fix is available.

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2015-7291

Produtos afetados

Arris Dg860A

Arris Tg862G

Referências · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-7291 · Nota de Segurança
• http://kb.cert.org/vuls/id/419568 · Nota