CSRF in Arris Dg860a

CVE-2015-7291

Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to hijack the authentication of arbitrary users.

Vulnerability class: CSRF (Cross-Site Request Forgery)

EPSS: 0.010 (57.7th percentile) — read the EPSS interpretation.

Affected products

Arris Dg860a
Arris Na_model_862_gw_mono_firmware — versions ts070593c_073013, ts0703128_100611, ts0703135_112211
Arris Tg862a
Arris Tg862g
N/a — versions n/a

Weakness classification (CWE)

CWE-352 — Cross-Site Request Forgery (CSRF)

References

cret@cert.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)