651 matches found
CVE-2018-10990
On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" cookie, which might make it easier for attackers to obtain access at a later time e.g., "at least for a few minutes"...
CVE-2018-10989: Initialization of a Resource with an Insecure Default
Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by...
CVE-2018-10990: Insufficient Session Expiration
On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" cookie, which might make it easier for attackers to obtain access at a later time e.g., "at least for a few minutes"...
PT-2018-10227
Name of the Vulnerable Software and Affected Versions Arris Touchstone Telephony Gateway TG1682G version 9.1.103J6 Description The device has a default password of password for the admin account, which is used over an unencrypted connection to http://192.168.0.1. This might allow remote attackers...
PT-2018-10229
Name of the Vulnerable Software and Affected Versions Arris Touchstone Telephony Gateway TG1682G version 9.1.103J6 Description The logout action on the device does not immediately destroy all state related to the validity of the credential cookie. This might allow attackers to obtain access at a...
Arris TG1682G Device Cross-Site Scripting Vulnerability
The Arris TG1682G devices is a Modem modem router all-in-one device from the Arris Group of companies in the U.S.A. The Comcast TG16822.0s7PRODse is a set of firmware developed by Comcast in the U.S.A. that is used in it. A cross-site scripting vulnerability exists in Arris TG1682G devices using...
CVE-2017-16836
Arris TG1682G devices with Comcast TG16822.0s7PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajaxmanagedservices.php service parameter...
CVE-2017-16836
Arris TG1682G devices with Comcast TG16822.0s7PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajaxmanagedservices.php service parameter...
Cross site scripting
Arris TG1682G devices with Comcast TG16822.0s7PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajaxmanagedservices.php service parameter...
CVE-2017-16836
CVE-2017-16836 describes an unauthenticated stored cross-site scripting (XSS) in Arris TG1682G devices running Comcast TG1682_2.0s7_PRODse 10.0.59.SIP.PC20.CT. The vulnerability is exploitable via the service parameter of actionHandler/ajax_managed_services.php, allowing an attacker to inject arb...
CVE-2017-16836
Arris TG1682G devices with Comcast TG16822.0s7PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajaxmanagedservices.php service parameter...
PT-2017-14585
Name of the Vulnerable Software and Affected Versions Arris TG1682G devices with Comcast TG1682 2.0s7 PRODse 10.0.59.SIP.PC20.CT software Description The issue allows Unauthenticated Stored XSS via the actionHandler/ajax managed services.php service parameter. This affects Arris TG1682G devices...
CVE-2017-16836: Improper Neutralization of Input During Web Page Generation
Arris TG1682G devices with Comcast TG16822.0s7PRODse 10.0.59.SIP.PC20.CT software allow Unauthenticated Stored XSS via the actionHandler/ajaxmanagedservices.php service parameter...
Security Vulnerabilities in AT&T Routers
They're actually Arris routers, sold or given away by AT&T.; There are several security vulnerabilities, some of them very serious. They can be fixed, but because these are routers it takes some skill. We don't know how many routers are affected, and estimates range from thousands to 138,000. Amo...
Arris NVG589 and NVG599 AT&T U-verse Authentication Vulnerabilities
The Arris NVG589 and NVG599 are both router products from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in... A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG589 and NVG599. A remote attacker could exploit this vulnerability ...
Arris NVG599 AT&T U-verse ROOT Acquisition Vulnerability
The Arris NVG599 is a router product from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in the. A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG599. A remote attacker can exploit this vulnerability to gain root privileges by...
Arris NVG589 and NVG599 AT&T U-verse Information Disclosure Vulnerabilities
The Arris NVG589 and NVG599 are both router products from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in... A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG589 and NVG599. A remote attacker could exploit the vulnerability t...
Arris NVG589 and NVG599 AT&T U-verse Command Injection Vulnerabilities
The Arris NVG589 and NVG599 are both router products from the Arris Group of Companies in the U.S. The AT&T U-verse is the firmware used in... A security vulnerability exists in the AT&T U-verse version 9.2.2h0d83 in the Arris NVG589 and NVG599. A remote attacker can exploit the vulnerability by...
Code injection
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01...
CVE-2017-14116
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 an...