Arris cable modems contain an undocumented backdoor vulnerability and XSS and CSRF

ronjor · Nov 20, 2015

Original Release date: 20 Nov 2015 | Last revised: 20 Nov 2015

Overview

Multiple models of Arris cable modems are publicly reported to contain multiple backdoor passwords, as well as multiple cross-site scripting (XSS) and cross-site request forgery (CSRF) vulnerabilities.
Click to expand...

http://www.kb.cert.org/vuls/id/419568

Gullible Jones · Nov 20, 2015

Groovy... I have one of those. And it doesn't look like coax cable modems are available in PCI card form. Sigh.

prius04 · Nov 20, 2015

Aren't all of those Arris models cable modem/routers (wireless gateways)? Further, aren't they all eMTAs?

Palancar · Nov 23, 2015

Wouldn't a solid linux router behind this "mess" mitigate much of the risk? Just wondering what the harm would be for an average home network with the assumption of a solid router being in place behind these bad modems?

Minimalist · Apr 7, 2016

CSRF Bug in Over 135 Million ARRIS Modems Lets Anyone Factory Reset the Devices

As security researcher David Longenecker explains, these cable modems have an unprotected Web-based administration panel that everyone on the local network can access by going to 192.168.100.1.
Click to expand...

http://news.softpedia.com/news/csrf...anyone-factory-reset-the-devices-502672.shtml

Log in or Sign up

Arris cable modems contain an undocumented backdoor vulnerability and XSS and CSRF

ronjor Global Moderator

Gullible Jones Registered Member

prius04 Registered Member

Palancar Registered Member

Minimalist Registered Member

Log in or Sign up

Arris cable modems contain an undocumented backdoor vulnerability and XSS and CSRF

ronjor Global Moderator

Gullible Jones Registered Member

prius04 Registered Member

Palancar Registered Member

Minimalist Registered Member

Useful Searches