CVEvulnerability
CVE-2014-8886
8.1 HIGH
Official page ↗
- Status
- Modified
- Published
- 2016-01-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.1 HIGH — CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-310
Description
AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image.
Affected configurations
• avm fritz\! os (<= 6.23)
Related
Weakness · not in database (1)
References
- http://packetstormsecurity.com/files/135161/AVM-FRITZ-Box-Arbitrary-Code-Execution-Via-Firmware-Images.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2016/Jan/12 Exploit
- http://www.securityfocus.com/archive/1/537246/100/0/threaded www.securityfocus.com
- https://avm.de/service/sicherheitsinfos-zu-updates/ Vendor Advisory
- https://www.redteam-pentesting.de/advisories/rt-sa-2014-014 Exploit
- http://packetstormsecurity.com/files/135161/AVM-FRITZ-Box-Arbitrary-Code-Execution-Via-Firmware-Images.html packetstormsecurity.com
- http://seclists.org/fulldisclosure/2016/Jan/12 Exploit
- http://www.securityfocus.com/archive/1/537246/100/0/threaded www.securityfocus.com
- https://avm.de/service/sicherheitsinfos-zu-updates/ Vendor Advisory
- https://www.redteam-pentesting.de/advisories/rt-sa-2014-014 Exploit