CVE-2022-45028

A cross-site scripting XSS vulnerability in Arris NVG443B 9.3.0h3d36 allows attackers to execute arbitrary web scripts or HTML via a crafted POST request sent to /cgi-bin/logs.ha...

ARRIS NVG443B 跨站脚本漏洞

The ARRIS NVG443B is a full-featured, high-performance gateway from ARRIS America. A security vulnerability exists in the ARRIS NVG443B version 9.3.0h3d36, which stems from the presence of cross-site scripting XSS that allows an attacker to execute arbitrary web script or HTML via a specially...

CVE-2022-45028

The CVE-2022-45028 entry concerns Arris NVG443B firmware 9.3.0h3d36. The vulnerability is a cross-site scripting (XSS) flaw that allows an attacker to execute arbitrary web scripts or HTML via a crafted POST to /cgi-bin/logs.ha. Per the connected sources, the impact is browser-execution of attack...

Arris Routers Command Injection (CVE-2022-26990; CVE-2022-26991; CVE-2022-26992; CVE-2022-26993; CVE-2022-26994; CVE-2022-26995; CVE-2022-26996; CVE-2022-26997; CVE-2022-26998; CVE-2022-26999; CVE-2022-27000; CVE-2022-27001; CVE-2022-27002)

A command injection vulnerability exists in Arris Routers. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Hands-On IoT Hacking: Rapid7 at DEF CON 30 IoT Village, Part 1

Rapid7 was back this year at DEF CON 30 participating at the IoT Village with another hands-on hardware hacking exercise, with the goal of teaching attendees' various concepts and methods for IoT hacking. Over the years, these exercises have covered several different embedded device topics,...

ARRIS Router Detection (HTTP)

HTTP detection of ARRIS routers. Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/...

ARRIS Routers Information Disclosure Vulnerability (Jun 2022) - Active Check

Multiple ARRIS routers are prone to an information disclosure vulnerability in the underlying muhttpd web server. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2022-31793

dorequest in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and...

CVE-2022-31793

dorequest in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and...

CVE-2022-31793

dorequest in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and...

Design/Logic Flaw

dorequest in request.c in muhttpd before 1.1.7 allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first character when serving files. Arris NVG443, NVG599, NVG589, and...

PT-2022-20938 · Arris · Bgw320 +5

Name of the Vulnerable Software and Affected Versions: muhttpd versions prior to 1.1.7 Description: The issue allows remote attackers to read arbitrary files by constructing a URL with a single character before a desired path on the filesystem. This occurs because the code skips over the first...

Millions of Arris routers are vulnerable to path traversal attacks

Security researcher Derek Abdine has published an advisory about vulnerabilities that exist in the MIT-licensed muhttpd web server. This web server is present in Arris firmware which can be found in several router models. muhttpd web server muhttpd mu HTTP deamon is a simple but complete web serv...

Millions of Arris routers are vulnerable to path traversal attacks

Security researcher Derek Abdine has published an advisory about vulnerabilities that exist in the MIT-licensed muhttpd web server. This web server is present in Arris firmware which can be found in several router models. muhttpd web server muhttpd mu HTTP deamon is a simple but complete web serv...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68529)

The ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS, Inc. A command injection vulnerability exists in the ARRIS TR3300, which stems from the failure of the wanipstat, wanmaskstat, wangwstat, and wandns1stat parameters in the ip function to properly filter the construct command special...

Multiple ARRIS Product Command Injection Vulnerabilities (CNVD-2022-68534)

ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P is a Wi-Fi router from ARRIS USA. Multiple ARRIS products are vulnerable to a command injection vulnerability, which stems from the TimeZone parameter in the ntp function failing to properly filter the construct command special characters, commands,...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68525)

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the upnpttl parameter in the upnp function failing to properly filter the construct command special characters, commands, etc. An attacker could exploit this...

ARRIS TR3300 Command Injection Vulnerability

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the failure of the hostname parameter in the dhcp function to properly filter the construct command special characters, commands, etc. An attacker could use this...

Multiple ARRIS Product Command Injection Vulnerabilities (CNVD-2022-68532)

ARRIS SBR-AC1900P, SBR-AC3200P and SBR-AC1200P is a Wi-Fi router from ARRIS, Inc. Multiple ARRIS products are vulnerable to a command injection vulnerability, which stems from the pptpUserName and pptpPassword parameters in the pptp function failing to properly filter the construct command specia...

ARRIS TR3300 Command Injection Vulnerability (CNVD-2022-68527)

ARRIS TR3300 is an 802.11ac Wi-Fi router from ARRIS U.S.A. A command injection vulnerability exists in ARRIS TR3300, which stems from the failure of the pptpfixip, pptpfixmask, pptpfixgw, and wandns1stat parameters in the pptp function. properly filter the construct command special characters,...