Vulnerability Description
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php, (2) add a port forwarding rule via a request to port_forwarding_add.php, (3) change the wireless network to open via a request to wireless_network_configuration_edit.php, or (4) conduct cross-site scripting (XSS) attacks via the keyword parameter to managed_sites_add_keyword.php.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Arris | Touchstone Tg862G\/Ct Firmware | <= 7.6.59s.ct |
| Arris | Touchstone Tg862G\/Ct | All versions |
Related Weaknesses (CWE)
References
- http://seclists.org/fulldisclosure/2014/Dec/57
- http://seclists.org/fulldisclosure/2014/Dec/58
- http://seclists.org/fulldisclosure/2014/Dec/57
- http://seclists.org/fulldisclosure/2014/Dec/58
FAQ
What is CVE-2014-5437?
CVE-2014-5437 is a vulnerability with a CVSS score of 6.8 (MEDIUM). Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of a...
How severe is CVE-2014-5437?
CVE-2014-5437 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2014-5437?
Check the references section above for vendor advisories and patch information. Affected products include: Arris Touchstone Tg862G\/Ct Firmware, Arris Touchstone Tg862G\/Ct.