« Volver al listado

CVE-2015-7290

Estado: ModificadaMedia (4.3)—

Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arris — NA Model 862 GW Mono Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-7290",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-11-21T11:59:18.247",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/419568",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/419568",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de XSS en adv_pwd_cgi en la interfaz de gestión web en dispositivos Arris DG860A, TG862A y TG862G con firmware TS0703128_100611 hasta la versión TS0705125D_031115 permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro pwd."
    }
  ],
  "lastModified": "2026-06-17T00:32:12.120",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts070593c_073013:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE587573-08E6-414D-98DC-9187C365F583"
            },
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts0703128_100611:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B86E7209-225B-465F-8127-21267B78A0D8"
            },
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts0703135_112211:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B1FFC16-7E5C-46B3-88FA-3B572227AC25"
            },
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts0705125_062314:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E630C0D-DAF6-4CFD-948E-E43CC7FA12D8"
            },
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts0705125d_031115:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF86A127-AC02-42B7-905F-46A3B7D618CC"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:arris:dg860a:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9F752C6F-5269-4330-A1B4-F575EF4ACD70"
            },
            {
              "criteria": "cpe:2.3:h:arris:tg862a:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "214B7318-F67E-4B24-81C7-51863868BE8B"
            },
            {
              "criteria": "cpe:2.3:h:arris:tg862g:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7C41240B-0116-4F89-93BB-553F9A30065F"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}