CVE-2025-49162

Arris / VIP1113 PUBLISHED

Description (CNA)

Arris VIP1113 devices through 2025-05-30 with KreaTV SDK allow file overwrite via TFTP because a remote filename with a space character allows an attacker to control the local filename.

Affected (CNA)

Vendor / product	Versions
Arris / VIP1113	affected 0 through 2025-05-30

CWE

CWE-424

References

https://full-disclosure.eu/reports/2025/FDEU-CVE-2025-1c00-arris-bootloader-shell-injection.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.