File Overwrite Vulnerability in Arris VIP1113 Devices
CVE-2025-49162

6.4MEDIUM

Key Information:

Vendor

Arris

Status
Vip1113
Vendor
CVE Published:
3 June 2025

What is CVE-2025-49162?

The Arris VIP1113 devices exploit a vulnerability within the KreaTV SDK that allows attackers to perform unauthorized file overwrites via TFTP. By sending a specially crafted remote filename containing a space character, the attacker can manipulate the local filename to overwrite critical system files, potentially leading to system disruption or unauthorized access.

Affected Version(s)

VIP1113 0 <= 2025-05-30

References

https://full-disclosure.eu/reports/2025/FDEU-CVE-2025-1c0...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.