Sign-up

ID

VAR-201511-0001


CVE

CVE-2009-5149


TITLE

ARRIS cable modems generate passwords deterministically and contain XSS and CSRF vulnerabilities

Trust: 0.8

sources: CERT/CC: VU#419568

DESCRIPTION

Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have predictable technician passwords, which makes it easier for remote attackers to obtain access via the web management interface, related to a "password of the day" issue. Multiple models of ARRIS cable modems contain multiple, deterministically generated backdoor passwords, as well as multiple cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities. Arris DG860A, TG862A and TG862G are modem products of the American Arris Group. A cross-site scripting vulnerability 2. A cross-site request-forgery vulnerability 3. Multiple security-bypass vulnerabilities An attacker can exploit these issues to bypass security restrictions and perform unauthorized actions, execute attacker-supplied HTML or JavaScript code in the context of the affected site or to steal cookie-based authentication credentials. This may aid in further attacks. The following products and versions are affected: Arris DG860A, TG862A, TG862G using firmware versions TS0703128_100611 to TS0705125D_031115

Trust: 3.24

sources: NVD: CVE-2009-5149 // CERT/CC: VU#419568 // JVNDB: JVNDB-2015-006006 // CNVD: CNVD-2015-07832 // BID: 77674 // VULHUB: VHN-42595

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2015-07832

AFFECTED PRODUCTS

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts0703135_112211

Trust: 1.6

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts0705125d_031115

Trust: 1.6

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts070593c_073013

Trust: 1.6

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts0705125_062314

Trust: 1.6

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts0703128_100611

Trust: 1.6

vendor:arrismodel: - scope: - version: -

Trust: 0.8

vendor:arris groupmodel:dg860ascope: - version: -

Trust: 0.8

vendor:arris groupmodel:na.model 862.gw.monoscope:eqversion:ts0703128_100611 to ts0705125d_031115

Trust: 0.8

vendor:arris groupmodel:tg862ascope: - version: -

Trust: 0.8

vendor:arris groupmodel:tg862gscope: - version: -

Trust: 0.8

vendor:arrismodel:dg860a ts0703128 100611 to ts0705125d 031115scope: - version: -

Trust: 0.6

vendor:arrismodel:tg862a ts0703128 100611 to ts0705125d 031115scope: - version: -

Trust: 0.6

vendor:arrismodel:tg862g ts0703128 100611 to ts0705125d 031115scope: - version: -

Trust: 0.6

vendor:arrismodel:tg862g ts070593c 073013 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862g ts0705125d 031115 nascope: - version: -

Trust: 0.3

vendor:arrismodel:tg862g ts0705125 062314 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862g ts0703135 112211 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862g ts0703128 100611 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts070593c 073013 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts0705125d 031115 nascope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts0705125 062314 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts0703135 112211 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts0703128 100611 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts070593c 073013 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts0705125d 031115 nascope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts0705125 062314 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts0703135 112211 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts0703128 100611 na.scope: - version: -

Trust: 0.3

sources: CERT/CC: VU#419568 // CNVD: CNVD-2015-07832 // BID: 77674 // JVNDB: JVNDB-2015-006006 // CNNVD: CNNVD-201511-379 // NVD: CVE-2009-5149

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2009-5149
value: MEDIUM

Trust: 1.0

NVD: CVE-2009-5149
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2015-07832
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201511-379
value: MEDIUM

Trust: 0.6

VULHUB: VHN-42595
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2009-5149
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-07832
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-42595
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2015-07832 // VULHUB: VHN-42595 // JVNDB: JVNDB-2015-006006 // CNNVD: CNNVD-201511-379 // NVD: CVE-2009-5149

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.9

sources: VULHUB: VHN-42595 // JVNDB: JVNDB-2015-006006 // NVD: CVE-2009-5149

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201511-379

TYPE

trust management

Trust: 0.6

sources: CNNVD: CNNVD-201511-379

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-006006

PATCH
title:A "password of the day" generator for Arris TM602A cable modems.url:https://github.com/borfast/arrispwgen
Trust: 0.8
title:Arris PODurl:https://play.google.com/store/apps/details?id=me.harrygonzalez.arrispod
Trust: 0.8
title:Patches for Multiple Arris Device Trust Management Vulnerabilities (CNVD-2015-07832)url:https://www.cnvd.org.cn/patchInfo/show/67317
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-07832 // 
            
            
            
            JVNDB: JVNDB-2015-006006

EXTERNAL IDS
db:CERT/CCid:VU#419568
Trust: 3.6
db:NVDid:CVE-2009-5149
Trust: 3.4
db:EXPLOIT-DBid:29131
Trust: 0.8
db:JVNid:JVNVU90662356
Trust: 0.8
db:JVNDBid:JVNDB-2015-006006
Trust: 0.8
db:CNNVDid:CNNVD-201511-379
Trust: 0.7
db:CNVDid:CNVD-2015-07832
Trust: 0.6
db:BIDid:77674
Trust: 0.3
db:VULHUBid:VHN-42595
Trust: 0.1
sources:
            
            
            CERT/CC: VU#419568 // 
            
            
            
            CNVD: CNVD-2015-07832 // 
            
            
            
            VULHUB: VHN-42595 // 
            
            
            
            BID: 77674 // 
            
            
            
            JVNDB: JVNDB-2015-006006 // 
            
            
            
            CNNVD: CNNVD-201511-379 // 
            
            
            
            NVD: CVE-2009-5149

REFERENCES
url:http://www.kb.cert.org/vuls/id/419568
Trust: 2.8
url:https://github.com/borfast/arrispwgen
Trust: 2.5
url:http://www.borfast.com/projects/arris-password-of-the-day-generator/
Trust: 2.3
url:https://play.google.com/store/apps/details?id=me.harrygonzalez.arrispod
Trust: 1.7
url:https://w00tsec.blogspot.com/2015/11/arris-cable-modem-has-backdoor-in.html
Trust: 0.8
url:https://www.shodan.io/search?query=arris+port%3a%2223%22
Trust: 0.8
url:https://www.shodan.io/search?query=ssh-2.0-arris_0.50
Trust: 0.8
url:https://www.shodan.io/search?query=net-dk
Trust: 0.8
url:http://www.theregister.co.uk/2015/11/20/arris_modem_backdoor/
Trust: 0.8
url:http://www.cert.br/docs/palestras/certbr-tcfirst2015.pdf
Trust: 0.8
url:https://www.exploit-db.com/exploits/29131/
Trust: 0.8
url:http://docsis.org/node/1575
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/255.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/259.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/80.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/352.html
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2009-5149
Trust: 0.8
url:http://jvn.jp/vu/jvnvu90662356/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2009-5149
Trust: 0.8
url:http://www.arrisi.com/
Trust: 0.3
sources:
            
            
            CERT/CC: VU#419568 // 
            
            
            
            CNVD: CNVD-2015-07832 // 
            
            
            
            VULHUB: VHN-42595 // 
            
            
            
            BID: 77674 // 
            
            
            
            JVNDB: JVNDB-2015-006006 // 
            
            
            
            CNNVD: CNNVD-201511-379 // 
            
            
            
            NVD: CVE-2009-5149

CREDITS
Bernardo Rodrigues
Trust: 0.3
sources:
            
            
            BID: 77674

SOURCES
db:CERT/CCid:VU#419568
db:CNVDid:CNVD-2015-07832
db:VULHUBid:VHN-42595
db:BIDid:77674
db:JVNDBid:JVNDB-2015-006006
db:CNNVDid:CNNVD-201511-379
db:NVDid:CVE-2009-5149

LAST UPDATE DATE
2024-08-14T14:27:33.570000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#419568date:2015-11-23T00:00:00
db:CNVDid:CNVD-2015-07832date:2015-11-27T00:00:00
db:VULHUBid:VHN-42595date:2015-11-23T00:00:00
db:BIDid:77674date:2015-11-20T00:00:00
db:JVNDBid:JVNDB-2015-006006date:2015-11-24T00:00:00
db:CNNVDid:CNNVD-201511-379date:2015-11-27T00:00:00
db:NVDid:CVE-2009-5149date:2015-11-23T16:52:56.430

SOURCES RELEASE DATE
db:CERT/CCid:VU#419568date:2015-11-20T00:00:00
db:CNVDid:CNVD-2015-07832date:2015-11-27T00:00:00
db:VULHUBid:VHN-42595date:2015-11-21T00:00:00
db:BIDid:77674date:2015-11-20T00:00:00
db:JVNDBid:JVNDB-2015-006006date:2015-11-24T00:00:00
db:CNNVDid:CNNVD-201511-379date:2015-11-23T00:00:00
db:NVDid:CVE-2009-5149date:2015-11-21T11:59:00.123