« Volver al listado

CVE-2015-7291

Estado: ModificadaMedia (6.8)—

Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to hijack the authentication of arbitrary users.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Arris — NA Model 862 GW Mono Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-7291",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-11-21T11:59:19.933",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/419568",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/419568",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to hijack the authentication of arbitrary users."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de CSRF en adv_pwd_cgi en la interfaz de gestión web en dispositivos Arris DG860A, TG862A y TG862G con firmware TS0703128_100611 hasta la versión TS0705125D_031115 permite a atacantes remotos secuestrar la autenticación de usuarios arbitrarios."
    }
  ],
  "lastModified": "2026-06-17T00:32:12.223",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts070593c_073013:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE587573-08E6-414D-98DC-9187C365F583"
            },
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts0703128_100611:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B86E7209-225B-465F-8127-21267B78A0D8"
            },
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts0703135_112211:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9B1FFC16-7E5C-46B3-88FA-3B572227AC25"
            },
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts0705125_062314:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0E630C0D-DAF6-4CFD-948E-E43CC7FA12D8"
            },
            {
              "criteria": "cpe:2.3:o:arris:na_model_862_gw_mono_firmware:ts0705125d_031115:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF86A127-AC02-42B7-905F-46A3B7D618CC"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:arris:dg860a:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "9F752C6F-5269-4330-A1B4-F575EF4ACD70"
            },
            {
              "criteria": "cpe:2.3:h:arris:tg862a:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "214B7318-F67E-4B24-81C7-51863868BE8B"
            },
            {
              "criteria": "cpe:2.3:h:arris:tg862g:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7C41240B-0116-4F89-93BB-553F9A30065F"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cret@cert.org"
}