Exploitation Summary
EIP tracks 2 public exploits for CVE-2014-8423.
PoCs published by HeadlessZeke, including Metasploit module exploits/linux/http/vap2500_tools_command_exec.
AI-analyzed exploit summary This Ruby script exploits an authentication bypass vulnerability in VAP2500 devices by leveraging weak MD5-based session cookies to execute arbitrary commands as root, modify the root password, and enable telnet access.
Description
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.
Exploits (2)
This Ruby script exploits an authentication bypass vulnerability in VAP2500 devices by leveraging weak MD5-based session cookies to execute arbitrary commands as root, modify the root password, and enable telnet access.
This Metasploit module exploits an OS command injection vulnerability in Arris VAP2500 access points via the tools_command.php page, bypassing authentication by setting a cookie to an MD5 hash of a valid username.