Sign-up

ID

VAR-201412-0521


CVE

CVE-2014-5437


TITLE

ARRIS Touchstone TG862G/CT Telephony Gateway Vulnerabilities in which access rights can be obtained in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2014-007277

DESCRIPTION

Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php, (2) add a port forwarding rule via a request to port_forwarding_add.php, (3) change the wireless network to open via a request to wireless_network_configuration_edit.php, or (4) conduct cross-site scripting (XSS) attacks via the keyword parameter to managed_sites_add_keyword.php. ARRIS Touchstone TG862G/CT Telephony Gateway Because the firmware of the default password of the administrator account password, there is a vulnerability to gain access.By a third party home_loggedout.php Access may be obtained through a request for. The ARRIS TG862G Route is a router. A cross-site request forgery vulnerability exists in the ARRIS TG862G Route due to a program failing to properly validate HTTP requests. Allow remote attackers to perform certain unauthorized operations. Other attacks are also possible. Arris TG862G running firmware version 7.6.59S.CT is vulnerable. Arris Touchstone TG862G/CT Telephony Gateway is a Modem (modem) router all-in-one machine produced by Arris Group Corporation of the United States

Trust: 3.24

sources: NVD: CVE-2014-5437 // JVNDB: JVNDB-2014-007277 // JVNDB: JVNDB-2014-007295 // CNVD: CNVD-2014-09002 // BID: 71699 // VULHUB: VHN-73379

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-09002

AFFECTED PRODUCTS

vendor:arris groupmodel:touchstone tg862g/ct telephony gatewayscope: - version: -

Trust: 1.6

vendor:arris groupmodel:touchstone tg862g/ct telephony gatewayscope:lteversion:7.6.59s.ct

Trust: 1.6

vendor:arrismodel:touchstone tg862g\/ctscope:lteversion:7.6.59s.ct

Trust: 1.0

vendor:arris groupmodel:tg862g 7.6.59s.ctscope: - version: -

Trust: 0.6

vendor:arrismodel:touchstone tg862g\/ctscope:eqversion:7.6.59s.ct

Trust: 0.6

vendor:arrismodel:group touchstone tg862g/ct 7.6.59s.ctscope: - version: -

Trust: 0.3

vendor:arrismodel:group touchstone tg862g/ct 7.6.86l.ctscope:neversion: -

Trust: 0.3

sources: CNVD: CNVD-2014-09002 // BID: 71699 // JVNDB: JVNDB-2014-007277 // JVNDB: JVNDB-2014-007295 // CNNVD: CNNVD-201412-391 // NVD: CVE-2014-5437

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-5437
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-5437
value: HIGH

Trust: 0.8

NVD: CVE-2014-5437
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2014-09002
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201412-391
value: MEDIUM

Trust: 0.6

VULHUB: VHN-73379
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-5437
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

NVD: CVE-2014-5437
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2014-09002
severity: MEDIUM
baseScore: 4.9
vectorString: AV:N/AC:M/AU:S/C:P/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: SINGLE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.8
impactScore: 4.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-73379
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2014-09002 // VULHUB: VHN-73379 // JVNDB: JVNDB-2014-007277 // JVNDB: JVNDB-2014-007295 // CNNVD: CNNVD-201412-391 // NVD: CVE-2014-5437

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

problemtype:CWE-255

Trust: 0.8

sources: VULHUB: VHN-73379 // JVNDB: JVNDB-2014-007277 // JVNDB: JVNDB-2014-007295 // NVD: CVE-2014-5437

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201412-391

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201412-391

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-007277

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-73379

PATCH
title:Touchstone TG862G/CT Telephony Gatewayurl:https://www.arrisi.com/support/documentation/user_guides/_docs/TG862G-CT_User_Guide_Standard1-0.pdf
Trust: 1.6
title:Patch for ARRIS TG862G Route Cross-Site Request Forgery Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/52937
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-09002 // 
            
            
            
            JVNDB: JVNDB-2014-007277 // 
            
            
            
            JVNDB: JVNDB-2014-007295

EXTERNAL IDS
db:NVDid:CVE-2014-5437
Trust: 4.2
db:BIDid:71699
Trust: 1.6
db:JVNDBid:JVNDB-2014-007277
Trust: 0.8
db:JVNDBid:JVNDB-2014-007295
Trust: 0.8
db:CNNVDid:CNNVD-201412-391
Trust: 0.7
db:CNVDid:CNVD-2014-09002
Trust: 0.6
db:PACKETSTORMid:129600
Trust: 0.1
db:VULHUBid:VHN-73379
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-09002 // 
            
            
            
            VULHUB: VHN-73379 // 
            
            
            
            BID: 71699 // 
            
            
            
            JVNDB: JVNDB-2014-007277 // 
            
            
            
            JVNDB: JVNDB-2014-007295 // 
            
            
            
            CNNVD: CNNVD-201412-391 // 
            
            
            
            NVD: CVE-2014-5437

REFERENCES
url:http://seclists.org/fulldisclosure/2014/dec/57
Trust: 3.6
url:http://seclists.org/fulldisclosure/2014/dec/58
Trust: 1.7
url:http://www.securityfocus.com/bid/71699
Trust: 1.2
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-9406
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-9406
Trust: 0.8
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-5437
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-5437
Trust: 0.8
url:http://www.arrisi.com/support/documentation/user_guides/_docs/arris_router_setup_web_gui_ug.pdf
Trust: 0.3
sources:
            
            
            CNVD: CNVD-2014-09002 // 
            
            
            
            VULHUB: VHN-73379 // 
            
            
            
            BID: 71699 // 
            
            
            
            JVNDB: JVNDB-2014-007277 // 
            
            
            
            JVNDB: JVNDB-2014-007295 // 
            
            
            
            CNNVD: CNNVD-201412-391 // 
            
            
            
            NVD: CVE-2014-5437

CREDITS
Seth Art
Trust: 0.9
sources:
            
            
            BID: 71699 // 
            
            
            
            CNNVD: CNNVD-201412-391

SOURCES
db:CNVDid:CNVD-2014-09002
db:VULHUBid:VHN-73379
db:BIDid:71699
db:JVNDBid:JVNDB-2014-007277
db:JVNDBid:JVNDB-2014-007295
db:CNNVDid:CNNVD-201412-391
db:NVDid:CVE-2014-5437

LAST UPDATE DATE
2025-04-13T23:34:06.235000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-09002date:2014-12-18T00:00:00
db:VULHUBid:VHN-73379date:2014-12-18T00:00:00
db:BIDid:71699date:2014-12-15T00:00:00
db:JVNDBid:JVNDB-2014-007277date:2014-12-19T00:00:00
db:JVNDBid:JVNDB-2014-007295date:2014-12-19T00:00:00
db:CNNVDid:CNNVD-201412-391date:2014-12-22T00:00:00
db:NVDid:CVE-2014-5437date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2014-09002date:2014-12-18T00:00:00
db:VULHUBid:VHN-73379date:2014-12-17T00:00:00
db:BIDid:71699date:2014-12-15T00:00:00
db:JVNDBid:JVNDB-2014-007277date:2014-12-19T00:00:00
db:JVNDBid:JVNDB-2014-007295date:2014-12-19T00:00:00
db:CNNVDid:CNNVD-201412-391date:2014-12-18T00:00:00
db:NVDid:CVE-2014-5437date:2014-12-17T18:59:00.067