CVE-2022-26998

This CVE affects Arris TR3300 v1.0.13, with a command injection vulnerability in the wps setting function through the wps_enrolee_pin parameter. The root cause is improper handling/filtering of crafted input in that parameter, enabling an attacker to execute arbitrary commands. The relevant advis...

CVE-2022-26998

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wpsenroleepin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26997

CVE-2022-26997 affects Arris TR3300 v1.0.13. A command injection flaw exists in the upnp function via the upnp_ttl parameter, allowing arbitrary command execution through a crafted request. Documented impact is high (remote attacker, network access). No explicit remediation/version patch is provi...

CVE-2022-26996

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoeusername, pppoepasswd, and pppoeservicename parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26996

CVE-2022-26996 affects Arris TR3300 v1.0.13, introducing a command-injection flaw in the pppoe function via crafted pppoe_username, pppoe_passwd, and pppoe_servicename parameters. Exploitation allows arbitrary command execution without user interaction. Public sources in the provided set (NVD/Red...

CVE-2022-26997

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnpttl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26995

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp wanpptp.html function via the pptpfixip, pptpfixmask, pptpfixgw, and wandns1stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26995

Arris TR3300 v1.0.13 is affected by a command injection vulnerability in the pptp function (pptp_fix_ip, pptp_fix_mask, pptp_fix_gw, wan_dns1_stat) exposed via the pptp/wang_pptp.html endpoints. The issue arises from insufficient input validation, enabling an attacker to craft a request that exec...

CVE-2022-26994

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pptp function via the pptpUserName and pptpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted...

CVE-2022-26993

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe function via the pppoeUserName, pppoePassword, and pppoeService parameters. This vulnerability allows attackers to execute arbitrary...

CVE-2022-26993

CVE-2022-26993 affects ARRIS SBR-AC1900P (1.0.7-B05), SBR-AC3200P (1.0.7-B05), and SBR-AC1200P (1.0.5-B05). A command-injection vulnerability exists in the pppoe function exploitable via the pppoeUserName, pppoePassword, and pppoe_Service parameters, enabling arbitrary command execution through a...

CVE-2022-26994

The CVE-2022-26994 issue affects Arris SBR-AC1900P (1.0.7-B05), SBR-AC3200P (1.0.7-B05), and SBR-AC1200P (1.0.5-B05). A command injection flaw exists in the pptp function via pptpUserName and pptpPassword that could allow an attacker to execute arbitrary commands. Mitigation guidance across sourc...

CVE-2022-26992

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns function via the DdnsUserName, DdnsHostName, and DdnsPassword parameters. This vulnerability allows attackers to execute arbitrary commands...

CVE-2022-26992

CVE-2022-26992 affects Arris SBR-AC1900P, SBR-AC3200P, and SBR-AC1200P. The vulnerability is a command injection in the ddns function, exploitable via DdnsUserName, DdnsHostName, and DdnsPassword parameters. Root cause stated in connected sources as improper filtering of certain characters in the...

CVE-2022-26990

Arris SBR-AC1900P (1.0.7-B05), SBR-AC3200P (1.0.7-B05) and SBR-AC1200P (1.0.5-B05) are affected by a command-injection vulnerability in the firewall-local log function, exploitable via EmailAddress, SmtpServerName, SmtpUsername and SmtpPassword. The issue allows arbitrary commands to be executed ...

CVE-2022-26991

CVE-2022-26991 concerns Arris routers SBR-AC1900P (1.0.7-B05), SBR-AC3200P (1.0.7-B05) and SBR-AC1200P (1.0.5-B05). A command-injection in the ntp function via the TimeZone parameter allows an attacker to execute arbitrary commands through a crafted request. Public sources consistently describe i...

CVE-2022-26991

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ntp function via the TimeZone parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26990

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the firewall-local log function via the EmailAddress, SmtpServerName, SmtpUsername, and SmtpPassword parameters. This vulnerability allows attackers...

PT-2022-18177 · Arris · Arris Tr3300

Name of the Vulnerable Software and Affected Versions: Arris TR3300 version 1.0.13 Description: The issue is related to a command injection vulnerability in the time and time zone function. This vulnerability is exploited via the h primary ntp server, h backup ntp server, and h time zone...

PT-2022-18166 · Arris · Sbr-Ac1900P +2

Name of the Vulnerable Software and Affected Versions: Arris routers SBR-AC1900P version 1.0.7-B05 Arris routers SBR-AC3200P version 1.0.7-B05 Arris routers SBR-AC1200P version 1.0.5-B05 Description: A command injection issue was discovered in the firewall-local log function, allowing attackers t...