CVE-2014-8423 – ARRIS VAP2500 Management Portal Remote Command Execution Vulnerability

https://notcve.org/view.php?id=CVE-2014-8423

Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors. Vulnerabilidad no especificada en el portal de gestión en ARRIS VAP2500 anterior a FW08.41 permite a atacantes remotos ejecutar comandos arbitrarios a través de vectores desconocidos. This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of ARRIS VAP2500. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of access to the management portal. The issue lies in the ability to execute arbitrary commands without any sanitization. • https://www.exploit-db.com/exploits/35372 http://www.zerodayinitiative.com/advisories/ZDI-14-389 http://goto.fail/blog/2014/11/25/at-and-t-u-verse-vap2500-the-passwords-they-do-nothing • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') •