Kaspersky Threats

KLA10704
Multiple vulnerabilities in ARRIS cable modems.

Aktualisiert: 03/29/2019

Erkennungsdatum ?	12/03/2015
Schweregrad ?	Kritisch
Beschreibung	Multiple serious vulnerabilities have been found in ARRIS cable modems. Malicious users can exploit these vulnerabilities to gain privileges or inject arbitrary code. Below is a complete list of vulnerabilities: Predictable technician password can be exploited remotely to gain technician privileges; Unknown vulnerability at web management interface can be exploited remotely to gain arbitrary user privileges; Unknown vulnerability at web management initerface can be exploited remotely via a specially designed pwd parameter to inject arbitrary script or HTML; Hardcoded administrator password can be exploited remotely from vectors related to web management interface, SSH, TELNET, SNMP to gain administrator privileges. Technical details Vulnerabilities (2, 3) related to adv_pwd_cgi. Vulnerability (4) caused by hardcoded administrators password derived from serial number.
Beeinträchtigte Produkte	Arris devices DG860A, TG862A, and TG862G with firmware versions from TS0703128_100611 through TS0705125D_031115
Lösung	Try to avoid using this accessory in accountable issues.
Ursprüngliche Informationshinweise	Vulnerability Notes Database
Folgen ?	CI [?] PE [?]
CVE-IDS ?	CVE-2015-72916.8Critical CVE-2015-72904.3Critical CVE-2009-51494.3Critical CVE-2015-72899.3Critical
	Link zum Original