Arris TG862G CVE-2014-5438 HTML Injection and Cross Site Scripting vulnerabilities
BID:71703
Info
Arris TG862G CVE-2014-5438 HTML Injection and Cross Site Scripting vulnerabilities
| Bugtraq ID: | 71703 |
| Class: | Input Validation Error |
| CVE: |
CVE-2014-5438 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 15 2014 12:00AM |
| Updated: | Dec 15 2014 12:00AM |
| Credit: | Seth Art |
| Vulnerable: |
ARRIS Group Touchstone TG862G/CT 7.6.59S.CT |
| Not Vulnerable: |
ARRIS Group Touchstone TG862G/CT 7.6.86L.CT |
Discussion
Arris TG862G CVE-2014-5438 HTML Injection and Cross Site Scripting vulnerabilities
Arris TG862G is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Arris TG862G is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability.
Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
Exploit / POC
Arris TG862G CVE-2014-5438 HTML Injection and Cross Site Scripting vulnerabilities
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue an attacker must entice an unsuspecting user into following a malicious URI.
Attackers can use a browser to exploit these issues. To exploit the cross-site scripting issue an attacker must entice an unsuspecting user into following a malicious URI.
References
Arris TG862G CVE-2014-5438 HTML Injection and Cross Site Scripting vulnerabilities
References:
References:
- ARRIS Homepage (ARRIS)
- CVE-2014-5438: Arris TG862G - Cross-site Scripting (XSS) (Seth Art)