CVE-2014-8886

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their...

8.1 High

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create symlinks or overwrite critical files, and consequently execute arbitrary code, via a crafted firmware image.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.14%Up 0.4 points since Feb 4, 2022

What each source reports

NVD Score used 8.1

Record: CVE-2014-8886
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-310
Updated: 2026-11-02

CVE List No score

Record: CVE-2014-8886
Updated: 2026-11-02

EUVDEUVD-2014-8713 No score

Record: EUVD-2014-8713
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w6v8-ffc7-5f5p 8.1

AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their...

Record: GHSA-w6v8-ffc7-5f5p
CVSS 3.0: 8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

avm fritz\! os

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-8886 is a high vulnerability (CVSS 8.1) in Avm Fritz\! Os, published January 8, 2016. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.14%, the 93rd percentile. No source names a fixed version.