XSS in Arris Dg860a

CVE-2015-7290

Cross-site scripting (XSS) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to inject arbitrary web script or HTML via the pwd parameter.

Vulnerability class: XSS (Cross-Site Scripting)

EPSS: 0.012 (64.2th percentile) — read the EPSS interpretation.

Affected products

Arris Dg860a
Arris Na_model_862_gw_mono_firmware — versions ts070593c_073013, ts0703128_100611, ts0703135_112211
Arris Tg862a
Arris Tg862g
N/a — versions n/a

Weakness classification (CWE)

CWE-79 — Cross-site Scripting

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)