KLA10704 Multiple vulnerabilities in ARRIS cable modems.

Multiple serious vulnerabilities have been found in ARRIS cable modems. Malicious users can exploit these vulnerabilities to gain privileges or inject arbitrary code. Below is a complete list of vulnerabilities: 1. Predictable technician password can be exploited remotely to gain technician...

CVE-2015-7290

The CVE-2015-7290 entry describes a Cross-site Scripting (XSS) vulnerability in the adv_pwd_cgi parameter of the Arris web management interface, affecting DG860A, TG862A, and TG862G devices. The root cause is reflected XSS via the pwd parameter, enabling an attacker to inject arbitrary web script...

ARRIS cable modems generate passwords deterministically and contain XSS and CSRF vulnerabilities

Overview Multiple models of ARRIS cable modems contain multiple, deterministically generated backdoor passwords, as well as multiple cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities. Description CWE-255: Credentials Management - CVE-2009-5149The 'password of the day'...