PT-2014-8517 · Arris · Arris Vap2500

Headlesszeke · Published 2014-11-25 · Updated 2014-11-28 · CVE-2014-8423

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions ARRIS VAP2500 versions prior to FW08.41

Description The issue concerns an unspecified vulnerability in the management portal of the ARRIS VAP2500. This vulnerability allows remote attackers to execute arbitrary commands. The exact vectors used for the attack are not specified.

Recommendations For ARRIS VAP2500 versions prior to FW08.41, update the firmware to FW08.41 or later to resolve the issue. As a temporary workaround, consider restricting access to the management portal to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2014-8423

ZDI-14-389

Affected Products

Arris Vap2500

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vap2500_tools_command_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/35372 · Exploit
• https://zerodayinitiative.com/advisories/ZDI-14-389 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-8423 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-14-389 · Note