CVE-2014-8423
CVE-2014-8423 is a critical-severity vulnerability in Arris Vap2500 Firmware with a CVSS 2.0 base score of 10.0. Its EPSS exploit-prediction score of 62% places it in the 99th percentile, indicating an elevated likelihood of exploitation. The underlying weakness is classified as CWE-74.
Key facts
- Severity: Critical (CVSS 2.0 base score 10.0)
- EPSS exploit prediction: 62% (99th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-74
- Affected product: Arris Vap2500 Firmware
- Published:
- Last modified:
Description
Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.
Frequently asked questions
- What is CVE-2014-8423?
- Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.
- How severe is CVE-2014-8423?
- CVE-2014-8423 has a CVSS 2.0 base score of 10.0, rated critical severity.
- Is CVE-2014-8423 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 62% (99th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2014-8423?
- CVE-2014-8423 affects Arris Vap2500 Firmware. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2014-8423?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
- When was CVE-2014-8423 published?
- CVE-2014-8423 was published on 2014-11-28 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:o:arris:vap2500_firmware:*:*:*:*:*:*:*:*
More vulnerabilities in Arris Vap2500 Firmware
- CVE-2014-8425 — High (CVSS 7.8): The management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to obtain credentials by reading the…
- CVE-2014-8424 — High (CVSS 7.8): ARRIS VAP2500 before FW08.41 does not properly validate passwords, which allows remote attackers to bypass…
- CVE-2024-5196 — Medium (CVSS 4.7): A vulnerability classified as critical has been found in Arris VAP2500 08.50. This affects an unknown part of the file…
- CVE-2024-5195 — Medium (CVSS 4.7): A vulnerability was found in Arris VAP2500 08.50. It has been rated as critical. Affected by this issue is some unknown…
- CVE-2024-5194 — Medium (CVSS 4.7): A vulnerability was found in Arris VAP2500 08.50. It has been declared as critical. Affected by this vulnerability is…
All CVEs affecting Arris Vap2500 Firmware →
Other CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities
- CVE-2026-25586 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, a sandbox escape is possible by shadowing hasOwnProperty…
- CVE-2026-25520 — Critical (CVSS 10.0): SandboxJS is a JavaScript sandboxing library. Prior to 0.8.29, The return values of functions aren't wrapped.…
- CVE-2025-20265 — Critical (CVSS 10.0): A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could…
- CVE-2025-20337 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
- CVE-2025-20281 — Critical (CVSS 10.0): A vulnerability in a specific API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
- CVE-2024-42472 — Critical (CVSS 10.0): Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.14.0 and 1.15.10, a malicious…
Browse all CWE-74 (Improper Neutralization of Special Elements (Injection)) vulnerabilities →