Sign-up

ID

VAR-201511-0055


CVE

CVE-2015-7291


TITLE

ARRIS cable modems generate passwords deterministically and contain XSS and CSRF vulnerabilities

Trust: 0.8

sources: CERT/CC: VU#419568

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to hijack the authentication of arbitrary users. Multiple models of ARRIS cable modems contain multiple, deterministically generated backdoor passwords, as well as multiple cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities. Arris DG860A, TG862A, TG862G devices are modem products of the American Arris Group. A remote attacker could exploit this vulnerability to perform unauthorized operations. A cross-site scripting vulnerability 2. A cross-site request-forgery vulnerability 3. Multiple security-bypass vulnerabilities An attacker can exploit these issues to bypass security restrictions and perform unauthorized actions, execute attacker-supplied HTML or JavaScript code in the context of the affected site or to steal cookie-based authentication credentials. This may aid in further attacks. The following products and versions are affected: Arris DG860A, TG862A, TG862G using firmware versions TS0703128_100611 to TS0705125D_031115

Trust: 3.24

sources: NVD: CVE-2015-7291 // CERT/CC: VU#419568 // JVNDB: JVNDB-2015-006009 // CNVD: CNVD-2015-07830 // BID: 77674 // VULHUB: VHN-85252

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2015-07830

AFFECTED PRODUCTS

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts0703135_112211

Trust: 1.6

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts0705125d_031115

Trust: 1.6

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts070593c_073013

Trust: 1.6

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts0705125_062314

Trust: 1.6

vendor:arrismodel:na model 862 gw monoscope:eqversion:ts0703128_100611

Trust: 1.6

vendor:arrismodel: - scope: - version: -

Trust: 0.8

vendor:arris groupmodel:dg860ascope: - version: -

Trust: 0.8

vendor:arris groupmodel:na.model 862.gw.monoscope:eqversion:ts0703128_100611 to ts0705125d_031115

Trust: 0.8

vendor:arris groupmodel:tg862ascope: - version: -

Trust: 0.8

vendor:arris groupmodel:tg862gscope: - version: -

Trust: 0.8

vendor:arrismodel:dg860a ts0703128 100611 to ts0705125d 031115scope: - version: -

Trust: 0.6

vendor:arrismodel:tg862a ts0703128 100611 to ts0705125d 031115scope: - version: -

Trust: 0.6

vendor:arrismodel:tg862g ts0703128 100611 to ts0705125d 031115scope: - version: -

Trust: 0.6

vendor:arrismodel:tg862g ts070593c 073013 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862g ts0705125d 031115 nascope: - version: -

Trust: 0.3

vendor:arrismodel:tg862g ts0705125 062314 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862g ts0703135 112211 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862g ts0703128 100611 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts070593c 073013 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts0705125d 031115 nascope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts0705125 062314 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts0703135 112211 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:tg862a ts0703128 100611 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts070593c 073013 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts0705125d 031115 nascope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts0705125 062314 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts0703135 112211 na.scope: - version: -

Trust: 0.3

vendor:arrismodel:dg860a ts0703128 100611 na.scope: - version: -

Trust: 0.3

sources: CERT/CC: VU#419568 // CNVD: CNVD-2015-07830 // BID: 77674 // JVNDB: JVNDB-2015-006009 // CNNVD: CNNVD-201511-384 // NVD: CVE-2015-7291

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-7291
value: MEDIUM

Trust: 1.0

NVD: CVE-2015-7291
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2015-07830
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201511-384
value: MEDIUM

Trust: 0.6

VULHUB: VHN-85252
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2015-7291
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2015-07830
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-85252
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2015-07830 // VULHUB: VHN-85252 // JVNDB: JVNDB-2015-006009 // CNNVD: CNNVD-201511-384 // NVD: CVE-2015-7291

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-85252 // JVNDB: JVNDB-2015-006009 // NVD: CVE-2015-7291

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201511-384

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201511-384

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-006009

PATCH
title:Top Pageurl:http://www.arris.com/
Trust: 0.8
title:TG862G/CTurl:http://arris.force.com/consumers/ConsumerProductDetail?p=a0ha000000GOZ3yAAH&c=Touchstone%20Modems%20and%20Gateways
Trust: 0.8
title:Patches for multiple Arris device cross-site request forgery vulnerabilitiesurl:https://www.cnvd.org.cn/patchInfo/show/67318
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2015-07830 // 
            
            
            
            JVNDB: JVNDB-2015-006009

EXTERNAL IDS
db:CERT/CCid:VU#419568
Trust: 4.2
db:NVDid:CVE-2015-7291
Trust: 3.4
db:EXPLOIT-DBid:29131
Trust: 0.8
db:JVNid:JVNVU90662356
Trust: 0.8
db:JVNDBid:JVNDB-2015-006009
Trust: 0.8
db:CNNVDid:CNNVD-201511-384
Trust: 0.7
db:CNVDid:CNVD-2015-07830
Trust: 0.6
db:BIDid:77674
Trust: 0.3
db:SEEBUGid:SSVID-89954
Trust: 0.1
db:VULHUBid:VHN-85252
Trust: 0.1
sources:
            
            
            CERT/CC: VU#419568 // 
            
            
            
            CNVD: CNVD-2015-07830 // 
            
            
            
            VULHUB: VHN-85252 // 
            
            
            
            BID: 77674 // 
            
            
            
            JVNDB: JVNDB-2015-006009 // 
            
            
            
            CNNVD: CNNVD-201511-384 // 
            
            
            
            NVD: CVE-2015-7291

REFERENCES
url:http://www.kb.cert.org/vuls/id/419568
Trust: 3.4
url:https://w00tsec.blogspot.com/2015/11/arris-cable-modem-has-backdoor-in.html
Trust: 0.8
url:https://github.com/borfast/arrispwgen
Trust: 0.8
url:https://www.shodan.io/search?query=arris+port%3a%2223%22
Trust: 0.8
url:https://www.shodan.io/search?query=ssh-2.0-arris_0.50
Trust: 0.8
url:https://www.shodan.io/search?query=net-dk
Trust: 0.8
url:http://www.theregister.co.uk/2015/11/20/arris_modem_backdoor/
Trust: 0.8
url:http://www.cert.br/docs/palestras/certbr-tcfirst2015.pdf
Trust: 0.8
url:https://www.exploit-db.com/exploits/29131/
Trust: 0.8
url:http://docsis.org/node/1575
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/255.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/259.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/80.html
Trust: 0.8
url:http://cwe.mitre.org/data/definitions/352.html
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-7291
Trust: 0.8
url:http://jvn.jp/vu/jvnvu90662356/index.html
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2015-7291
Trust: 0.8
url:http://www.arrisi.com/
Trust: 0.3
sources:
            
            
            CERT/CC: VU#419568 // 
            
            
            
            CNVD: CNVD-2015-07830 // 
            
            
            
            VULHUB: VHN-85252 // 
            
            
            
            BID: 77674 // 
            
            
            
            JVNDB: JVNDB-2015-006009 // 
            
            
            
            CNNVD: CNNVD-201511-384 // 
            
            
            
            NVD: CVE-2015-7291

CREDITS
Bernardo Rodrigues
Trust: 0.3
sources:
            
            
            BID: 77674

SOURCES
db:CERT/CCid:VU#419568
db:CNVDid:CNVD-2015-07830
db:VULHUBid:VHN-85252
db:BIDid:77674
db:JVNDBid:JVNDB-2015-006009
db:CNNVDid:CNNVD-201511-384
db:NVDid:CVE-2015-7291

LAST UPDATE DATE
2024-11-23T22:13:22.403000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#419568date:2015-11-23T00:00:00
db:CNVDid:CNVD-2015-07830date:2015-11-27T00:00:00
db:VULHUBid:VHN-85252date:2015-11-23T00:00:00
db:BIDid:77674date:2015-11-20T00:00:00
db:JVNDBid:JVNDB-2015-006009date:2015-11-24T00:00:00
db:CNNVDid:CNNVD-201511-384date:2015-11-23T00:00:00
db:NVDid:CVE-2015-7291date:2024-11-21T02:36:31.517

SOURCES RELEASE DATE
db:CERT/CCid:VU#419568date:2015-11-20T00:00:00
db:CNVDid:CNVD-2015-07830date:2015-11-27T00:00:00
db:VULHUBid:VHN-85252date:2015-11-21T00:00:00
db:BIDid:77674date:2015-11-20T00:00:00
db:JVNDBid:JVNDB-2015-006009date:2015-11-24T00:00:00
db:CNNVDid:CNNVD-201511-384date:2015-11-23T00:00:00
db:NVDid:CVE-2015-7291date:2015-11-21T11:59:19.933