CVE-2014-8424

This Metasploit module exploits an OS command injection vulnerability in Arris VAP2500 access points via the tools_command.php page, bypassing authentication by setting a cookie to an MD5 hash of a valid username.

This Ruby script exploits an authentication bypass vulnerability in VAP2500 devices by leveraging weak MD5-based session cookies to execute arbitrary commands as root, modify the root password, and enable telnet access.