PT-2014-6472

Name of the Vulnerable Software and Affected Versions ARRIS Touchstone TG862G/CT Telephony Gateway versions 7.6.59S.CT and earlier Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or...

PT-2014-6471

Name of the Vulnerable Software and Affected Versions ARRIS Touchstone TG862G/CT Telephony Gateway versions 7.6.59S.CT and earlier Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including enabling remote management via "remote...

CVE-2014-5437: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that 1 enable remote management via a request to remotemanagement.php, 2...

CVE-2014-5438: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computername parameter to connecteddevicescomputersedit.php...

Arris Touchstone TG862G/CT Cross Site Request Forgery

----------- Vendor: ----------- Arris Interactive, LLC http://www.arrisi.com/ ISP: Comcast Xfinity ----------------------------------------- Affected Products/Versions: ----------------------------------------- HW: Arris Touchstone TG862G/CT Xfinity branded SW: Version 7.6.59S.CT Tested...

Arris Touchstone TG862G/CT Cross Site Scripting

----------- Vendor: ----------- Arris Interactive, LLC http://www.arrisi.com/ ISP: Comcast Xfinity ----------------------------------------- Affected Products/Versions: ----------------------------------------- HW: Arris Touchstone TG862G/CT Xfinity branded SW: Version 7.6.59S.CT Tested...

ARRIS VAP2500 Management Portal Authentication Bypass Vulnerability

ARRIS VAP2500 - WIRELESS VIDEO ACCESS POINT This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ARRIS VAP2500. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of user authentication. The iss...

ARRIS VAP2500 Management Portal Information Disclosure Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ARRIS VAP2500. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of access to the management portal. The issue lies in the failure to restri...

ARRIS VAP2500 Management Portal Remote Command Execution Vulnerability

ARRIS VAP2500 - WIRELESS VIDEO ACCESS POINT This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ARRIS VAP2500. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of access to the management...

CVE-2014-8425

The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files...

CVE-2014-8424

ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication...

CVE-2014-8423

Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors...

Design/Logic Flaw

The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files...

Authentication flaw

ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication...

Code injection

Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors...

EUVD-2014-8262

The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files...

CVE-2014-8423

Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors...

CVE-2014-8424

ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication...

CVE-2014-8425

The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the configuration files...

CVE-2014-8423

Arris VAP2500 devices are affected by CVE-2014-8423 in the management portal, enabling OS command injection/remote code execution via the tools_command.php page. Exploitation can bypass authentication by tampering a cookie (md5 hash of a valid username), allowing remote command execution with roo...