Bootloader Vulnerability in Arris VIP1113 Devices Using KreaTV SDK
CVE-2025-49163

6.7MEDIUM

Key Information:

Vendor

Arris

Status
Vip1113
Vendor
CVE Published:
3 June 2025

What is CVE-2025-49163?

The Arris VIP1113 devices, utilizing the KreaTV SDK, are vulnerable to a bootloader exploit that allows unauthorized booting of arbitrary images. This security flaw is detected in the handling of crafted files within the /usr/bin/gunzip directory, potentially leading to unauthorized access or system manipulation. Affected devices are at risk until a patch is applied.

Affected Version(s)

VIP1113 0 <= 2025-05-30

References

https://full-disclosure.eu/reports/2025/FDEU-CVE-2025-1c0...

CVSS V3.1

Score:
6.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-49163 : Bootloader Vulnerability in Arris VIP1113 Devices Using KreaTV SDK