PT-2019-14399 · Commscope · Commscope Arris Tr4400
Publicado
2019-08-29
·
Atualizado
2020-08-24
·
CVE-2019-15806
CVSS v3.1
9.8
Crítica
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301
Description
The issue allows for an authentication bypass to the administrative interface. This is possible because the current base64 encoded password is included within the http://192.168.1.1/basic sett.html page. Any user connected to the Wi-Fi can exploit this, potentially gaining unauthorized access to the device's administrative functions.
Recommendations
For CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301, consider restricting access to the administrative interface until a patch is available. As a temporary workaround, avoid using the
password variable in the affected API endpoint, and restrict access to the http://192.168.1.1/basic sett.html page to minimize the risk of exploitation.Exploit
Correção
Inadequate Encryption Strength
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Commscope Arris Tr4400