CVE-2014-8872 — HIGH (7.8) — White Hats Nepal

Vulnerability Description

Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50.

CVSS Score

7.8

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Avm	Fritz\!Box 6810 Lte Firmware	-
Avm	Fritz\!Box 6810 Lte	-
Avm	Fritz\!Box 6840 Lte Firmware	-
Avm	Fritz\!Box 6840 Lte	-

Related Weaknesses (CWE)

CWE-94

References

http://packetstormsecurity.com/files/130040/AVM-FRITZ-Box-Firmware-Signature-BypExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2015/Jan/86ExploitMailing ListThird Party Advisory
http://www.securityfocus.com/archive/1/534522/100/0/threaded
http://packetstormsecurity.com/files/130040/AVM-FRITZ-Box-Firmware-Signature-BypExploitThird Party AdvisoryVDB Entry
http://seclists.org/fulldisclosure/2015/Jan/86ExploitMailing ListThird Party Advisory
http://www.securityfocus.com/archive/1/534522/100/0/threaded

FAQ

What is CVE-2014-8872?

CVE-2014-8872 is a vulnerability with a CVSS score of 7.8 (HIGH). Improper Verification of Cryptographic Signature in AVM FRITZ!Box 6810 LTE after firmware 5.22, FRITZ!Box 6840 LTE after firmware 5.23, and other models with firmware 5.50.

How severe is CVE-2014-8872?

CVE-2014-8872 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2014-8872?

Check the references section above for vendor advisories and patch information. Affected products include: Avm Fritz\!Box 6810 Lte Firmware, Avm Fritz\!Box 6810 Lte, Avm Fritz\!Box 6840 Lte Firmware, Avm Fritz\!Box 6840 Lte.