PT-2025-23561 · Arris · Arris Vip1113

Published 2025-06-02 · Updated 2025-06-03 · CVE-2025-49164

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Arris VIP1113 devices with KreaTV SDK through 2025-05-30

Description The issue concerns a firmware decryption key exposure. The key is cd1c2d78f2cba1f73ca7e697b4a485f49a8a7d0c8b0fdc9f51ced50f2530668a.

Recommendations For Arris VIP1113 devices with KreaTV SDK through 2025-05-30, consider restricting access to the firmware until a patch or update is available that addresses the exposed decryption key. As a temporary workaround, avoid using the exposed key for any decryption processes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2025-49164

Affected Products

Arris Vip1113

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-49164 · Security Note
• https://t.me/cvetracker/25223 · Telegram Post
• https://full-disclosure.eu/reports/2025/FDEU-CVE-2025-1c00-arris-bootloader-shell-injection.html · Note
• https://twitter.com/CVEnew/status/1929687279032799561 · Twitter Post
• https://t.me/cvenotify/124408 · Telegram Post