Trust Management Vulnerability in Multiple Arris Devices (CNVD-2015-07832)

The Arris DG860A, TG862A and TG862G are modem products from the Arris Group of Companies. A security vulnerability exists in a number of Arris devices that stems from the program's use of predictable technician passwords. The vulnerability can be exploited by a remote attacker to gain access via...

Trust Management Vulnerability in Multiple Arris Devices

The Arris DG860A, TG862A and TG862G are modem products from the Arris Group of Companies. A security vulnerability exists in a number of Arris devices that stems from a program using hard-coded passwords based on serial numbers. The vulnerability can be exploited by a remote attacker to gain acce...

CVE-2009-5149

Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 have predictable technician passwords, which makes it easier for remote attackers to obtain access via the web management interface, related to a "password of the day" issue...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in advpwdcgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 allows remote attackers to hijack the authentication of arbitrary users...

Design/Logic Flaw

Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 have predictable technician passwords, which makes it easier for remote attackers to obtain access via the web management interface, related to a "password of the day" issue...

CVE-2009-5149

CVE-2009-5149 affects ARRIS DG860A, TG862A and TG862G cable modems with firmware TS0703128_100611 through TS0705125D_031115. The issue is a predictable technician password (“password of the day”) that can be exploited remotely to gain access via the web management interface. CERT/CC details furth...

CVE-2015-7289

The CVE-2015-7289 entry applies to ARRIS DG860A, TG862A, and TG862G cable modems with firmware TS0703128_100611 through TS0705125D_031115. The root cause is a hardcoded administrator password derived from the device serial number, enabling remote attackers to gain administrative access via the we...

CVE-2015-7291

Cross-site request forgery CSRF vulnerability in advpwdcgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 allows remote attackers to hijack the authentication of arbitrary users...

PT-2015-7507

Name of the Vulnerable Software and Affected Versions Arris DG860A versions TS0703128 100611 through TS0705125D 031115 Arris TG862A versions TS0703128 100611 through TS0705125D 031115 Arris TG862G versions TS0703128 100611 through TS0705125D 031115 Description The issue concerns a hardcoded...

CVE-2015-7289: Undefined Security Weakness

Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 have a hardcoded administrator password derived from a serial number, which makes it easier for remote attackers to obtain access via the web management interface, SSH, TELNET, or SNMP...

CVE-2009-5149: Undefined Security Weakness

Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 have predictable technician passwords, which makes it easier for remote attackers to obtain access via the web management interface, related to a "password of the day" issue...

PT-2015-3464

Name of the Vulnerable Software and Affected Versions Arris DG860A versions TS0703128 100611 through TS0705125D 031115 Arris TG862A versions TS0703128 100611 through TS0705125D 031115 Arris TG862G versions TS0703128 100611 through TS0705125D 031115 Description The issue is related to a "password ...

PT-2015-7508

Name of the Vulnerable Software and Affected Versions Arris DG860A versions TS0703128 100611 through TS0705125D 031115 Arris TG862A versions TS0703128 100611 through TS0705125D 031115 Arris TG862G versions TS0703128 100611 through TS0705125D 031115 Description A cross-site scripting XSS issue...

CVE-2015-7291: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in advpwdcgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-7290: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in advpwdcgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128100611 through TS0705125D031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter...

PT-2015-7509

Name of the Vulnerable Software and Affected Versions Arris DG860A versions TS0703128 100611 through TS0705125D 031115 Arris TG862A versions TS0703128 100611 through TS0705125D 031115 Arris TG862G versions TS0703128 100611 through TS0705125D 031115 Description A cross-site request forgery CSRF...

ARRIS cable modems generate passwords deterministically and contain XSS and CSRF vulnerabilities

Overview Multiple models of ARRIS cable modems contain multiple, deterministically generated backdoor passwords, as well as multiple cross-site scripting XSS and cross-site request forgery CSRF vulnerabilities. Description CWE-255: Credentials Management - CVE-2009-5149The 'password of the day'...