CVE-2014-8424
ARRIS VAP2500 < 08.41 - Authentication Bypass via Improper Password Validation
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2014-8424.
PoCs published by HeadlessZeke, including Metasploit module exploits/linux/http/vap2500_tools_command_exec.
AI-analyzed exploit summary This Metasploit module exploits an OS command injection vulnerability in Arris VAP2500 access points via the tools_command.php page, bypassing authentication by setting a cookie to an MD5 hash of a valid username.
Description
ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass authentication.
Exploits (2)
This Metasploit module exploits an OS command injection vulnerability in Arris VAP2500 access points via the tools_command.php page, bypassing authentication by setting a cookie to an MD5 hash of a valid username.
This Ruby script exploits an authentication bypass vulnerability in VAP2500 devices by leveraging weak MD5-based session cookies to execute arbitrary commands as root, modify the root password, and enable telnet access.