CVE-2014-8423

This Ruby script exploits an authentication bypass vulnerability in VAP2500 devices by leveraging weak MD5-based session cookies to execute arbitrary commands as root, modify the root password, and enable telnet access.

This Metasploit module exploits an OS command injection vulnerability in Arris VAP2500 access points via the tools_command.php page, bypassing authentication by setting a cookie to an MD5 hash of a valid username.