Arris TG862G Router CVE-2014-5437 Cross Site Request Forgery Vulnerability

Bugtraq ID:	71699
Class:	Input Validation Error
CVE:	CVE-2014-5437
Remote:	Yes
Local:	No
Published:	Dec 15 2014 12:00AM
Updated:	Dec 15 2014 12:00AM
Credit:	Seth Art
Vulnerable:	ARRIS Group Touchstone TG862G/CT 7.6.59S.CT
Not Vulnerable:	ARRIS Group Touchstone TG862G/CT 7.6.86L.CT

Arris TG862G Router CVE-2014-5437 Cross Site Request Forgery Vulnerability

Arris TG862G is prone to a cross-site request-forgery vulnerability because it fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Arris TG862G running firmware version 7.6.59S.CT is vulnerable.

Arris TG862G Router CVE-2014-5437 Cross Site Request Forgery Vulnerability

An attacker can exploit this issue by enticing an unsuspecting user to follow a malicious URI.

Arris TG862G Router CVE-2014-5437 Cross Site Request Forgery Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Arris TG862G Router CVE-2014-5437 Cross Site Request Forgery Vulnerability

References:

• Arris Router Setup Page (arris)
  
• CVE-2014-5437: Arris TG862G - Cross-site Request Forgery (CSRF) (SecLists.Org)