CVE-2015-7291: arris na_model_862_gw_mono_firmware Cross-Site Request Forgery (CSRF)

Vulnerability summary

CVE-2015-7291 is a medium (CVSS 6.8) Cross-Site Request Forgery (CSRF) vulnerability in arris na_model_862_gw_mono_firmware. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 60.8% of scored vulnerabilities.

Timeline

1. 21-11-2015
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG860A, TG862A, and TG862G devices with firmware TS0703128_100611 through TS0705125D_031115 allows remote attackers to hijack the authentication of arbitrary users.

• CWE-352Cross-Site Request Forgery (CSRF)The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.