CVE-2022-27002

The Arris TR3300 v1.0.13 802.11ac Wi-Fi router contains a command injection vulnerability within its ddns function . Attackers can execute arbitrary commands by sending a crafted request leveraging the ddns_name , ddns_pwd , h_ddns , or ddns_host parameters. Exploitation of this flaw allows for r...

CVE-2022-27001

Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-27001

CVE-2022-27001 affects Arris TR3300 v1.0.13 and is caused by a command injection vulnerability in the DHCP hostname parameter, allowing arbitrary command execution via a crafted request. The issue is documented across multiple sources (ARRIS/TR3300, Red Hat advisory, CNVD/CNVD-like records) and i...

CVE-2022-27000

Arris TR3300 v1.0.13 is affected by a command-injection vulnerability in the time and time zone function, exploitable via h_primary_ntp_server, h_backup_ntp_server, and h_time_zone parameters. The issue allows arbitrary command execution and is described across multiple sources (NVD/Red Hat/CNVD/...

CVE-2022-27000

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the hprimaryntpserver, hbackupntpserver, and htimezone parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26999

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wanipstat, wanmaskstat, wangwstat, and wandns1stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26999

Arris TR3300 v1.0.13 is affected by a command-injection vulnerability in the static IP settings function, exploitable via wan_ip_stat, wan_mask_stat, wan_gw_stat, and wan_dns1_stat parameters. Successful exploitation allows arbitrary commands to be executed; CVSS v3.1 base score 9.8 (CRITICAL). M...

CVE-2022-26998

This CVE affects Arris TR3300 v1.0.13, with a command injection vulnerability in the wps setting function through the wps_enrolee_pin parameter. The root cause is improper handling/filtering of crafted input in that parameter, enabling an attacker to execute arbitrary commands. The relevant advis...

CVE-2022-26998

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wpsenroleepin parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26997

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnpttl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26997

CVE-2022-26997 affects Arris TR3300 v1.0.13. A command injection flaw exists in the upnp function via the upnp_ttl parameter, allowing arbitrary command execution through a crafted request. Documented impact is high (remote attacker, network access). No explicit remediation/version patch is provi...

CVE-2022-26996

CVE-2022-26996 affects Arris TR3300 v1.0.13, introducing a command-injection flaw in the pppoe function via crafted pppoe_username, pppoe_passwd, and pppoe_servicename parameters. Exploitation allows arbitrary command execution without user interaction. Public sources in the provided set (NVD/Red...

CVE-2022-26996

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoeusername, pppoepasswd, and pppoeservicename parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26995

Arris TR3300 v1.0.13 is affected by a command injection vulnerability in the pptp function (pptp_fix_ip, pptp_fix_mask, pptp_fix_gw, wan_dns1_stat) exposed via the pptp/wang_pptp.html endpoints. The issue arises from insufficient input validation, enabling an attacker to craft a request that exec...

CVE-2022-26995

Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp wanpptp.html function via the pptpfixip, pptpfixmask, pptpfixgw, and wandns1stat parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

CVE-2022-26993

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pppoe function via the pppoeUserName, pppoePassword, and pppoeService parameters. This vulnerability allows attackers to execute arbitrary...

CVE-2022-26994

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the pptp function via the pptpUserName and pptpPassword parameters. This vulnerability allows attackers to execute arbitrary commands via a crafted...

CVE-2022-26993

CVE-2022-26993 affects ARRIS SBR-AC1900P (1.0.7-B05), SBR-AC3200P (1.0.7-B05), and SBR-AC1200P (1.0.5-B05). A command-injection vulnerability exists in the pppoe function exploitable via the pppoeUserName, pppoePassword, and pppoe_Service parameters, enabling arbitrary command execution through a...

CVE-2022-26994

The CVE-2022-26994 issue affects Arris SBR-AC1900P (1.0.7-B05), SBR-AC3200P (1.0.7-B05), and SBR-AC1200P (1.0.5-B05). A command injection flaw exists in the pptp function via pptpUserName and pptpPassword that could allow an attacker to execute arbitrary commands. Mitigation guidance across sourc...

CVE-2022-26992

Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in the ddns function via the DdnsUserName, DdnsHostName, and DdnsPassword parameters. This vulnerability allows attackers to execute arbitrary commands...