Arris Touchstone DG950A CVE-2014-4862 Remote Information Disclosure Vulnerability

Bugtraq ID:	69631
Class:	Design Error
CVE:	CVE-2014-4863
Remote:	Yes
Local:	No
Published:	Aug 21 2014 12:00AM
Updated:	Aug 21 2014 12:00AM
Credit:	Deral Heiland and Matthew Kienow.
Vulnerable:	ARRIS Group Touchstone DG950A 7.10.131
Not Vulnerable:

Arris Touchstone DG950A CVE-2014-4862 Remote Information Disclosure Vulnerability

Arris Touchstone DG950A is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to gain access to sensitive information. This may aid in further attacks.

Arris Touchstone DG950A 7.10.131 is vulnerable.

Arris Touchstone DG950A CVE-2014-4862 Remote Information Disclosure Vulnerability

The researcher who discovered this issue has created a proof-of-concept. Please see the references for more information.

Arris Touchstone DG950A CVE-2014-4862 Remote Information Disclosure Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Arris Touchstone DG950A CVE-2014-4862 Remote Information Disclosure Vulnerability

References:

• More SNMP Information Leaks: CVE-2014-4862 and CVE-2014-4863 (Rapid7)
  
• Touchstone Cable Modems Homepage (Arris Group)
  
• Vulnerability Note VU#259548 Netmaster cable modem information leakage vulnerabi (CERT)