What is CVE-2017-10793?

CVE-2017-10793 is a high-severity vulnerability in Att U-Verse Firmware, classified under Information Disclosure. CVSS score: 8.1/10. Published 2017-09-03.

How severe is CVE-2017-10793?

High severity. CVSS v3 base score is 8.1 out of 10.

Information disclosure in Att U-Verse Firmware

CVE-2017-10793

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive information (such as the Wi-Fi password) by leveraging knowledge of a hardware identifier, related to the Bulk Data Collection (BDC) mechanism defined in Broadband Forum technical reports.

Vulnerability class: Information Disclosure

EPSS: 0.028 (84.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.1 (High). Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Att U-verse_firmware — versions 9.2.2h0d83
Commscope Arris_nvg589
Commscope Arris_nvg599
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

cve@mitre.org (Third Party Advisory, x_refsource_MISC)
cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)
cve@mitre.org (Technical Description, Exploit, Third Party Advisory, x_refsource_MISC, Mitigation)

Frequently asked questions

What is CVE-2017-10793?: CVE-2017-10793 is a high-severity vulnerability in Att U-Verse Firmware, classified under Information Disclosure. CVSS score: 8.1/10. Published 2017-09-03.
How severe is CVE-2017-10793?: High severity. CVSS v3 base score is 8.1 out of 10.