PT-2014-8518 · Arris · Arris Vap2500

Headlesszeke + 1 · Published 2014-11-25 · Updated 2014-11-28 · CVE-2014-8424

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions ARRIS VAP2500 versions prior to FW08.41

Description The issue allows remote attackers to bypass authentication due to improper password validation.

Recommendations For ARRIS VAP2500 versions prior to FW08.41, update to FW08.41 or later to resolve the issue.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2014-8424

ZDI-14-388

Affected Products

Arris Vap2500

References · 5

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/vap2500_tools_command_exec.rb · Exploit
• 🔥 https://exploit-db.com/exploits/35372 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-8424 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-14-388 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-14-388 · Note