Sign-up

ID

VAR-201406-0395


CVE

CVE-2014-3778


TITLE

ARRIS SBG901 SURFboard Wireless Cable Modem of goform/RgDdns Vulnerable to cross-site request forgery

Trust: 0.8

sources: JVNDB: JVNDB-2014-003001

DESCRIPTION

Multiple cross-site request forgery (CSRF) vulnerabilities in goform/RgDdns in ARRIS (formerly Motorola) SBG901 SURFboard Wireless Cable Modem allow remote attackers to hijack the authentication of administrators for requests that (1) change the dns service via the DdnsService parameter, (2) change the username via the DdnsUserName parameter, (3) change the password via the DdnsPassword parameter, or (4) change the host name via the DdnsHostName parameter. The Motorola SBG901 modem is a router device. The Motorola SBG901 modem has a cross-site request forgery vulnerability that allows remote attackers to build malicious URIs, entice users to resolve, and perform malicious operations in the target user context. An attacker can exploit this issue to perform certain unauthorized actions. This may lead to further attacks

Trust: 2.43

sources: NVD: CVE-2014-3778 // JVNDB: JVNDB-2014-003001 // CNVD: CNVD-2014-03873 // BID: 68103

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-03873

AFFECTED PRODUCTS

vendor:commscopemodel:arris sbg901scope:eqversion: -

Trust: 1.0

vendor:arris groupmodel:sbg901 surfboard wireless cable modemscope: - version: -

Trust: 0.8

vendor:motorolamodel:sbg901 modemscope: - version: -

Trust: 0.6

vendor:arrismodel:sbg901scope:eqversion: -

Trust: 0.6

vendor:motorolamodel:sbg901scope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2014-03873 // BID: 68103 // JVNDB: JVNDB-2014-003001 // CNNVD: CNNVD-201406-442 // NVD: CVE-2014-3778

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-3778
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-3778
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2014-03873
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201406-442
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2014-3778
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2014-03873
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2014-03873 // JVNDB: JVNDB-2014-003001 // CNNVD: CNNVD-201406-442 // NVD: CVE-2014-3778

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.8

sources: JVNDB: JVNDB-2014-003001 // NVD: CVE-2014-3778

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201406-442

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201406-442

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-003001

PATCH
title:Modems and Gatewaysurl:http://www.arrisi.com/modems/
Trust: 0.8
title:Patch for Motorola SBG901 Cross-Site Request Forgery Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/46738
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-03873 // 
            
            
            
            JVNDB: JVNDB-2014-003001

EXTERNAL IDS
db:NVDid:CVE-2014-3778
Trust: 3.3
db:EXPLOIT-DBid:33792
Trust: 3.0
db:BIDid:68103
Trust: 0.9
db:JVNDBid:JVNDB-2014-003001
Trust: 0.8
db:EXPLOITDBid:33792
Trust: 0.6
db:CNVDid:CNVD-2014-03873
Trust: 0.6
db:CNNVDid:CNNVD-201406-442
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-03873 // 
            
            
            
            BID: 68103 // 
            
            
            
            JVNDB: JVNDB-2014-003001 // 
            
            
            
            CNNVD: CNNVD-201406-442 // 
            
            
            
            NVD: CVE-2014-3778

REFERENCES
url:http://www.exploit-db.com/exploits/33792
Trust: 1.6
url:http://www.exploit-db.com/exploits/33792/
Trust: 1.4
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-3778
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-3778
Trust: 0.8
url:http://www.arrisi.com/modems/
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2014-03873 // 
            
            
            
            BID: 68103 // 
            
            
            
            JVNDB: JVNDB-2014-003001 // 
            
            
            
            CNNVD: CNNVD-201406-442 // 
            
            
            
            NVD: CVE-2014-3778

CREDITS
Blessen Thomas
Trust: 0.3
sources:
            
            
            BID: 68103

SOURCES
db:CNVDid:CNVD-2014-03873
db:BIDid:68103
db:JVNDBid:JVNDB-2014-003001
db:CNNVDid:CNNVD-201406-442
db:NVDid:CVE-2014-3778

LAST UPDATE DATE
2025-04-12T23:13:20.866000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-03873date:2014-06-25T00:00:00
db:BIDid:68103date:2014-06-18T00:00:00
db:JVNDBid:JVNDB-2014-003001date:2014-06-23T00:00:00
db:CNNVDid:CNNVD-201406-442date:2021-08-24T00:00:00
db:NVDid:CVE-2014-3778date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2014-03873date:2014-06-25T00:00:00
db:BIDid:68103date:2014-06-18T00:00:00
db:JVNDBid:JVNDB-2014-003001date:2014-06-23T00:00:00
db:CNNVDid:CNNVD-201406-442date:2014-06-20T00:00:00
db:NVDid:CVE-2014-3778date:2014-06-19T14:55:07.253