CVE-2017-14116
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.34%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 and then installing new software, such as BusyBox with "nc -l" support.
- CVSS 3.0
- 8.1 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 3.34% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-798
- Affected
- att/u-verse firmware
- Source
- cve@mitre.org
References
- http://www.securityfocus.com/bid/100585Third Party Advisory, VDB Entry
- https://threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753/Third Party Advisory
- https://www.nomotion.net/blog/sharknatto/Exploit, Mitigation, Technical Description, Third Party Advisory
- http://www.securityfocus.com/bid/100585Third Party Advisory, VDB Entry
- https://threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753/Third Party Advisory
- https://www.nomotion.net/blog/sharknatto/Exploit, Mitigation, Technical Description, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.