Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 have predictable technician passwords, which makes it easier for remote attackers to obtain access via the web management interface, related to a "password of the day" issue.
References
| Link | Resource |
|---|---|
| http://www.borfast.com/projects/arris-password-of-the-day-generator/ | Exploit |
| http://www.kb.cert.org/vuls/id/419568 | Third Party Advisory US Government Resource |
| https://github.com/borfast/arrispwgen | Exploit |
| https://play.google.com/store/apps/details?id=me.harrygonzalez.arrispod | Patch |
| http://www.borfast.com/projects/arris-password-of-the-day-generator/ | Exploit |
| http://www.kb.cert.org/vuls/id/419568 | Third Party Advisory US Government Resource |
| https://github.com/borfast/arrispwgen | Exploit |
| https://play.google.com/store/apps/details?id=me.harrygonzalez.arrispod | Patch |
Configurations
Configuration 1 (hide)
| AND |
|
History
21 Nov 2024, 01:11
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.borfast.com/projects/arris-password-of-the-day-generator/ - Exploit | |
| References | () http://www.kb.cert.org/vuls/id/419568 - Third Party Advisory, US Government Resource | |
| References | () https://github.com/borfast/arrispwgen - Exploit | |
| References | () https://play.google.com/store/apps/details?id=me.harrygonzalez.arrispod - Patch |
Information
Published : 2015-11-21 11:59
Updated : 2024-11-21 01:11
NVD link : CVE-2009-5149
Mitre link : CVE-2009-5149
CVE.ORG link : CVE-2009-5149
JSON object : View
Products Affected
arris
- na_model_862_gw_mono_firmware
- tg862a
- dg860a
- tg862g
CWE
CWE-255
Credentials Management Errors