CVE-2025-49162: Arris VIP1113 Path Traversal Vulnerability

CVE-2025-49162 Overview

CVE-2025-49162 affects Arris VIP1113 set-top box devices running the KreaTV Software Development Kit (SDK) through 2025-05-30. The vulnerability allows an attacker to overwrite arbitrary local files through the Trivial File Transfer Protocol (TFTP) client. A remote filename containing a space character enables the attacker to control the local filename written to disk. The flaw is categorized as an improper handling of untrusted input by a downstream component [CWE-424]. Exploitation requires physical access to the device, but successful attacks can compromise firmware integrity and device availability.

Critical Impact
Attackers with physical access can overwrite arbitrary files on affected Arris VIP1113 devices, enabling firmware tampering and persistent compromise of the set-top box.

Affected Products

Arris VIP1113 set-top box devices
KreaTV SDK builds through 2025-05-30
Bootloader and TFTP client components shipped with affected firmware

Discovery Timeline

2025-06-03 - CVE-2025-49162 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49162

Vulnerability Analysis

The vulnerability resides in the TFTP client shipped with the KreaTV SDK on Arris VIP1113 devices. TFTP transfers accept a remote filename and typically write the retrieved content to a local file bearing the same name. The affected implementation fails to sanitize whitespace in the supplied remote filename. When a filename contains a space character, the client parses the value in a way that lets the attacker specify an arbitrary local destination path.

An attacker leveraging this parsing weakness can overwrite files on the device filesystem. Because the set-top box relies on integrity of its boot components and system binaries, arbitrary file overwrite can be chained with related bootloader shell injection issues documented in the Full Disclosure Report FDEU-CVE-2025-1c00 to achieve persistent code execution.

Root Cause

The root cause is improper handling of the remote filename argument by the TFTP client. The parser treats the space character as a delimiter, splitting the value and allowing a second token to redirect the local write path. This constitutes an improper control of a downstream component behavior [CWE-424].

Attack Vector

Exploitation requires physical access to the device and a controlled TFTP server on the local network. The attacker triggers a TFTP transfer specifying a crafted remote filename containing a space and an alternate local path. The device writes the retrieved content to the attacker-chosen location, overwriting existing files. Detailed exploitation steps are documented in the referenced full disclosure report; no synthetic proof-of-concept is reproduced here.

Detection Methods for CVE-2025-49162

Indicators of Compromise

Unexpected TFTP client sessions initiated from Arris VIP1113 devices to unauthorized servers
Modified timestamps or checksums on firmware, bootloader, or configuration files
Presence of foreign binaries or scripts in system directories not shipped by the vendor
Boot-time log entries indicating file replacement or integrity check failures

Detection Strategies

Baseline firmware images and periodically compare deployed files against known-good hashes
Monitor network segments hosting set-top boxes for outbound TFTP (UDP port 69) traffic to untrusted destinations
Inspect device logs for TFTP filenames containing whitespace or unexpected path separators

Monitoring Recommendations

Enable network flow logging on VLANs serving VIP1113 devices and alert on TFTP traffic
Restrict physical access to deployed set-top boxes and log access to service rooms and racks
Track vendor advisories from Arris and CommScope for KreaTV SDK security updates

How to Mitigate CVE-2025-49162

Immediate Actions Required

Inventory all Arris VIP1113 devices and identify units running KreaTV SDK builds dated on or before 2025-05-30
Restrict physical access to affected devices, since exploitation requires local proximity
Block or filter TFTP traffic on network segments where set-top boxes operate unless required for provisioning
Verify firmware integrity across the deployed fleet using vendor-supplied hashes

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry for CVE-2025-49162. Operators should contact Arris or CommScope support for guidance on updated KreaTV SDK builds. Consult the Full Disclosure Report FDEU-CVE-2025-1c00 for additional technical context on the disclosure.

Workarounds

Disable TFTP client functionality on affected devices where operationally feasible
Segment set-top boxes onto isolated management VLANs with strict egress filtering
Implement port security and 802.1X authentication to limit rogue TFTP server placement
Enforce tamper-evident enclosures and physical security controls on deployed units

bash

# Configuration example: block outbound TFTP from set-top box VLAN
iptables -A FORWARD -s 10.20.30.0/24 -p udp --dport 69 -j DROP
iptables -A FORWARD -s 10.20.30.0/24 -p udp --sport 69 -j DROP