PT-2015-7509 · Arris · Arris Tg862G+1

Bernardo Rodrigues · Published 2015-11-21 · Updated 2015-11-23 · CVE-2015-7291

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Arris DG860A versions TS0703128 100611 through TS0705125D 031115 Arris TG862A versions TS0703128 100611 through TS0705125D 031115 Arris TG862G versions TS0703128 100611 through TS0705125D 031115

Description A cross-site request forgery (CSRF) issue exists in the adv pwd cgi component of the web management interface, allowing remote attackers to hijack the authentication of arbitrary users.

Recommendations For Arris DG860A versions TS0703128 100611 through TS0705125D 031115, consider disabling access to the adv pwd cgi component in the web management interface until a fix is available. For Arris TG862A versions TS0703128 100611 through TS0705125D 031115, consider disabling access to the adv pwd cgi component in the web management interface until a fix is available. For Arris TG862G versions TS0703128 100611 through TS0705125D 031115, consider disabling access to the adv pwd cgi component in the web management interface until a fix is available.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2015-7291

Affected Products

Arris Dg860A

Arris Tg862G

References · 2

• https://nvd.nist.gov/vuln/detail/CVE-2015-7291 · Security Note
• http://kb.cert.org/vuls/id/419568 · Note