CVE-2025-49162

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allows an attacker to control the local filename.

Score

CVSS 3.1 6.4 Medium

Status

Deferred - cve@mitre.org

Published

2025-06-03

Last modified

2025-06-03

Weaknesses

CWE-424

Affected products

• Vip1113 (Arris)

References

• https://full-disclosure.eu/reports/2025/FDEU-CVE-2025-1c00-arris-bootloader-shell-injection.html