Vulnerabilities > CVE-2014-8886 - Cryptographic Issues vulnerability in AVM Fritz! OS 6.23

047910
CVSS 8.1 - HIGH
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
HIGH
Availability impact
HIGH
network
high complexity
avm
CWE-310
NVD
Published: 2016-01-08
Updated: 2024-11-21

Summary

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image.

Vulnerable Configurations

Part Description Count
OS
Avm
1

Common Weakness Enumeration (CWE)

Common Attack Pattern Enumeration and Classification (CAPEC)

  • Signature Spoofing by Key Recreation
    An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.

Packetstorm

data sourcehttps://packetstormsecurity.com/files/download/135161/rt-sa-2014-014.txt
idPACKETSTORM:135161
last seen2016-12-05
published2016-01-07
reporterredteam-pentesting.de
sourcehttps://packetstormsecurity.com/files/135161/AVM-FRITZ-Box-Arbitrary-Code-Execution-Via-Firmware-Images.html
titleAVM FRITZ!Box: Arbitrary Code Execution Via Firmware Images

References