PT-2019-14398 · Commscope · Commscope Arris Tr4400

Publicado 2019-08-29 · Atualizado 2020-08-24 · CVE-2019-15805

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301

Description The issue concerns an authentication bypass to the administrative interface. It is possible because the current base64 encoded password is included within the "http://192.168.1.1/login.html" endpoint. Any user connected to the Wi-Fi can exploit this.

Recommendations For CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301, consider restricting access to the administrative interface until a patch is available. As a temporary workaround, avoid using the "http://192.168.1.1/login.html" endpoint for authentication. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Inadequate Encryption Strength

Enumeração de Fraquezas

CWE-326

Identificadores relacionados

CVE-2019-15805

Produtos afetados

Commscope Arris Tr4400

Referências · 4

• 🔥 https://medium.com/@v.roberthoutenbrink/commscope-vulnerability-authentication-bypass-in-arris-tr4400-firmware-version-a1-00-004-180301-4a90aa8e7570 · Exploit
• https://medium.com/%40v.roberthoutenbrink/commscope-vulnerability-authentication-bypass-in-arris-tr4400-firmware-version-a1-00-004-180301-4a90aa8e7570 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2019-15805 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2019-15805 · Aviso do Fabricante