AVM FRITZ!OS < 6.30 Multiple Vulnerabilities

AVM FRITZ!Box devices running AVM FRITZ!OS before 6.30 are prone multiple vulnerabilities. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE ...

Multiple AVM FRITZ!Box WPA2 Key Reinstallation Vulnerabilities - KRACK

WPA2 as used in several models of the AVM FRITZ!Box are prone to multiple security weaknesses aka Key Reinstallation Attacks KRACK. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2014-8872

Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50...

Input validation

Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50...

CVE-2014-8872

Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50...

CVE-2014-8872

Summary: CVE-2014-8872 covers an improper verification of cryptographic signatures in AVM FRITZ!Box firmware images. Affected products (examples): FRITZ!Box 6810 LTE (firmware 5.22+), FRITZ!Box 6840 LTE (firmware 5.23+), and other models with firmware 5.50. Root cause (as described): The firmware...

Multiple AVM FRITZ!Box VoIP Remote Code Execution

Several models of the AVM FRITZ!Box are vulnerable to a heap-based buffer overflow, which allows attackers to execute arbitrary code on the device. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective...

AVM FRITZ!Box Default Password (FTP)

This script detects if the device has a default password set. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/o:avm:fritz%21os";...

AVM FRITZ!Box Default / no Password (HTTP)

This script detects if the device has: - a default password set - no password set SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

AVM FRITZ!Box Detection (HTTP)

HTTP based detection of AVM FRITZ!Box devices. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AVM FRITZ!Box Detection (SIP)

SIP based detection of AVM FRITZ!Box devices. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AVM FRITZ!Box Detection (UPnP)

UPnP based detection of AVM FRITZ!Box devices. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AVM FRITZ!Box Detection (FTP)

FTP based detection of AVM FRITZ!Box devices. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2015-7242

Cross-site scripting XSS vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the display name in the FROM field of an SIP INVITE message...

Cross site scripting

Cross-site scripting XSS vulnerability in the Push-Service-Mails feature in AVM FRITZ!OS before 6.30 allows remote attackers to inject arbitrary web script or HTML via the display name in the FROM field of an SIP INVITE message...

CVE-2015-7242

AVM FRITZ!OS

CVE-2014-8886

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image...

Code injection

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image...

CVE-2014-8886

AVM FRITZ!OS before 6.30 is affected by a vulnerability where the firmware update package is extracted before cryptographic signature verification. This allows a remote attacker to create symlinks or overwrite critical files via a crafted firmware image, potentially leading to arbitrary code exec...

CVE-2014-8886

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image...