CVE-2015-7291: Cross-site request forgery (CSRF) vulnerability in adv_pwd_cgi in the web management interface on Arris DG8...

Security readout for executives and security teams

CVE-2015-7291 is a CSRF flaw in the web management interface of specific Arris cable gateway models. If an authenticated administrator is tricked into visiting attacker-controlled content, the attacker may be able to act through that administrator’s browser. The bundle does not provide severity, CVSS, patch status, or active exploitation evidence. Exposure is likely limited to organizations or users still operating the listed Arris DG860A, TG862A, or TG862G devices on the affected firmware range. Risk increases where administrators access the management interface from regular browsing sessions or where the management interface is reachable beyond trusted networks. Treat this as a legacy network-edge hygiene issue. It is not listed as known exploited in the provided data, but affected devices can control network settings. Prioritize discovery and remediation where these models still protect business users or expose administration beyond trusted networks. Mitigation focus: Check Arris, ISP, or CERT guidance for firmware or replacement direction.; Restrict web management access to trusted local networks only.; Disable remote administration where that option exists..

Prepared

Jun 13, 2026, 21:45 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.