Filtered by vendor Commscope Subscriptions

Search

Switch to Advanced Search (Beta)
Total 61 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2021-33220 1 Commscope 1 Ruckus Iot Controller 2024-11-21 7.8 High
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. Hard-coded API Keys exist.
CVE-2021-33219 1 Commscope 1 Ruckus Iot Controller 2024-11-21 9.8 Critical
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded Web Application Administrator Passwords for the admin and nplus1user accounts.
CVE-2021-33218 1 Commscope 1 Ruckus Iot Controller 2024-11-21 9.8 Critical
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Hard-coded System Passwords that provide shell access.
CVE-2021-33217 1 Commscope 1 Ruckus Iot Controller 2024-11-21 8.8 High
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root.
CVE-2021-33216 1 Commscope 1 Ruckus Iot Controller 2024-11-21 9.8 Critical
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. An Undocumented Backdoor exists, allowing shell access via a developer account.
CVE-2021-33215 1 Commscope 1 Ruckus Iot Controller 2024-11-21 4.3 Medium
An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The API allows Directory Traversal.
CVE-2021-20120 1 Commscope 2 Arris Surfboard Sb8200, Arris Surfboard Sb8200 Firmware 2024-11-21 8.8 High
The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means that an attacker could make configuration changes (such as changing the administrative password) without the consent of the user.
CVE-2021-20119 1 Commscope 2 Arris Surfboard Sb8200, Arris Surfboard Sb8200 Firmware 2024-11-21 7.1 High
The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the administrator password.
CVE-2020-9476 1 Commscope 2 Arris Tg1692a, Arris Tg1692a Firmware 2024-11-21 7.5 High
ARRIS TG1692A devices allow remote attackers to discover the administrator login name and password by reading the /login page and performing base64 decoding.
CVE-2020-8830 1 Commscope 2 Ruckus Zoneflex R500, Ruckus Zoneflex R500 Firmware 2024-11-21 8.8 High
CSRF in login.asp on Ruckus devices allows an attacker to access the panel, and use SSRF to perform scraping or other analysis via the SUBCA-1 field on the Wireless Admin screen.
CVE-2020-8033 1 Commscope 2 Ruckus Zoneflex R500, Ruckus Zoneflex R500 Firmware 2024-11-21 6.1 Medium
Ruckus R500 3.4.2.0.384 devices allow XSS via the index.asp Device Name field.
CVE-2020-7983 1 Commscope 2 Ruckus Zoneflex R500, Ruckus Zoneflex R500 Firmware 2024-11-21 8.1 High
A CSRF issue in login.asp on Ruckus R500 3.4.2.0.384 devices allows remote attackers to access the panel or conduct SSRF attacks.
CVE-2020-26879 1 Commscope 2 Ruckus Iot Module, Ruckus Vriot 2024-11-21 9.8 Critical
Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization header.
CVE-2020-26878 1 Commscope 2 Ruckus Iot Module, Ruckus Vriot 2024-11-21 8.8 High
Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root user via web.py.
CVE-2019-15806 1 Commscope 2 Tr4400, Tr4400 Firmware 2024-11-21 N/A
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/basic_sett.html. Any user connected to the Wi-Fi can exploit this.
CVE-2019-15805 1 Commscope 2 Tr4400, Tr4400 Firmware 2024-11-21 N/A
CommScope ARRIS TR4400 devices with firmware through A1.00.004-180301 are vulnerable to an authentication bypass to the administrative interface because they include the current base64 encoded password within http://192.168.1.1/login.html. Any user connected to the Wi-Fi can exploit this.
CVE-2018-20386 1 Commscope 2 Arris Sbg6580-2, Arris Sbg6580-2 Firmware 2024-11-21 9.8 Critical
ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVE-2018-20383 2 Arris, Commscope 4 Dg950s Firmware, Arris Dg950a, Arris Dg950a Firmware and 1 more 2024-11-21 9.8 Critical
ARRIS DG950A 7.10.145 and DG950S 7.10.145.EURO devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and iso.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SNMP requests.
CVE-2018-17555 1 Commscope 2 Arris Tg2492lg-na, Arris Tg2492lg-na Firmware 2024-11-21 7.5 High
The web component on ARRIS TG2492LG-NA 061213 devices allows remote attackers to obtain sensitive information via the /snmpGet oids parameter.
CVE-2018-10990 1 Commscope 2 Arris Tg1682g, Arris Tg1682g Firmware 2024-11-21 8.0 High
On Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices, a logout action does not immediately destroy all state on the device related to the validity of the "credential" cookie, which might make it easier for attackers to obtain access at a later time (e.g., "at least for a few minutes"). NOTE: there is no documentation stating that the web UI's logout feature was supposed to do anything beyond removing the cookie from one instance of a web browser; a client-side logout action is often not intended to address cases where a person has made a copy of a cookie outside of a browser.