549 matches found
Default credentials
Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by...
CVE-2018-10990
On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" cookie, which might make it easier for attackers to obtain access at a later time e.g., "at least for a few minutes"...
CVE-2018-10989
Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by...
CVE-2018-10990
The CVE-2018-10990 entry affects Arris Touchstone Telephony Gateway TG1682G (version 9.1.103J6). The vulnerability arises because a logout action does not immediately destroy all state related to the validity of the credential cookie, potentially allowing an attacker to retain access for some min...
CVE-2018-10989
Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by...
CVE-2018-10989
The CVE-2018-10989 entry concerns Arris Touchstone Telephony Gateway TG1682G (version 9.1.103J6). The vulnerability arises from a default admin password ("password") that is used over an unencrypted http://192.168.0.1 interface, enabling a remote attacker with local network access to bypass acces...
CVE-2018-10990
On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" cookie, which might make it easier for attackers to obtain access at a later time e.g., "at least for a few minutes"...
Arris TG1682G Device Cross-Site Scripting Vulnerability
The Arris TG1682G devices is a Modem modem router all-in-one device from the Arris Group of companies in the U.S.A. The Comcast TG16822.0s7PRODse is a set of firmware developed by Comcast in the U.S.A. that is used in it. A cross-site scripting vulnerability exists in Arris TG1682G devices using...
CVE-2017-16836
Arris TG1682G devices with Comcast TG16822.0s7PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajaxmanagedservices.php service parameter...
CVE-2017-16836
Arris TG1682G devices with Comcast TG16822.0s7PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajaxmanagedservices.php service parameter...
Cross site scripting
Arris TG1682G devices with Comcast TG16822.0s7PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajaxmanagedservices.php service parameter...
CVE-2017-16836
Arris TG1682G devices with Comcast TG16822.0s7PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajaxmanagedservices.php service parameter...
CVE-2017-16836
CVE-2017-16836 describes an unauthenticated stored cross-site scripting (XSS) in Arris TG1682G devices running Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT. The vulnerability is exploitable via the service parameter of actionHandler/ajax_managed_services.php, allowing an attacker to inject arb...
Security Vulnerabilities in AT&T Routers
They're actually Arris routers, sold or given away by AT&T.; There are several security vulnerabilities, some of them very serious. They can be fixed, but because these are routers it takes some skill. We don't know how many routers are affected, and estimates range from thousands to 138,000. Amo...
Arris NVG589 and NVG599 AT&T U-verse Command Injection Vulnerabilities
The Arris NVG589 and NVG599 are both router products from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in... A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG589 and NVG599. A remote attacker can exploit the vulnerability by...
Arris NVG599 AT&T U-verse ROOT Acquisition Vulnerability
The Arris NVG599 is a router product from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in the. A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG599. A remote attacker can exploit this vulnerability to gain root privileges by...
Arris NVG589 and NVG599 AT&T U-verse Authentication Vulnerabilities
The Arris NVG589 and NVG599 are both router products from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in... A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG589 and NVG599. A remote attacker could exploit this vulnerability ...
Arris NVG589 and NVG599 AT&T U-verse Information Disclosure Vulnerabilities
The Arris NVG589 and NVG599 are both router products from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in... A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG589 and NVG599. A remote attacker could exploit the vulnerability t...
Design/Logic Flaw
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive...
Code injection
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 an...