What’s Vulnerable › Vulnerabilities

CVE-2014-8886

• Severity: high (CVSS 8.1 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2016-01-08 · updated 2026-06-17
• Weakness: CWE-310

Description

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image.

Affected products

• Avm Fritz! Os: through 6.23

References

• http://packetstormsecurity.com/files/135161/AVM-FRITZ-Box-Arbitrary-Code-Execution-Via-Firmware-Images.html
• http://seclists.org/fulldisclosure/2016/Jan/12
• http://www.securityfocus.com/archive/1/537246/100/0/threaded
• https://avm.de/service/sicherheitsinfos-zu-updates/
• https://www.redteam-pentesting.de/advisories/rt-sa-2014-014
• http://packetstormsecurity.com/files/135161/AVM-FRITZ-Box-Arbitrary-Code-Execution-Via-Firmware-Images.html
• http://seclists.org/fulldisclosure/2016/Jan/12
• http://www.securityfocus.com/archive/1/537246/100/0/threaded
• https://avm.de/service/sicherheitsinfos-zu-updates/
• https://www.redteam-pentesting.de/advisories/rt-sa-2014-014

Get alerted when CVE-2014-8886 or the next vulnerability affects your stack