What is CVE-2018-10989?

CVE-2018-10989 is a medium-severity vulnerability in Commscope Arris Tg1682g, classified under Initialization of a Resource with an Insecure Default. CVSS score: 6.6/10. Published 2018-05-14.

How severe is CVE-2018-10989?

Medium severity. CVSS v3 base score is 6.6 out of 10.

RCE in Commscope Arris Tg1682g

CVE-2018-10989

Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by leveraging access to the local network. NOTE: one or more user's guides distributed by ISPs state "At a minimum, you should set a login password."

EPSS: 0.014 (69.6th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.6 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Commscope Arris_tg1682g
Commscope Arris_tg1682g_firmware — versions 9.1.103j6
N/a — versions n/a

Weakness classification (CWE)

CWE-1188 — Initialization of a Resource with an Insecure Default

References

cve@mitre.org (x_refsource_MISC)

Frequently asked questions

What is CVE-2018-10989?: CVE-2018-10989 is a medium-severity vulnerability in Commscope Arris Tg1682g, classified under Initialization of a Resource with an Insecure Default. CVSS score: 6.6/10. Published 2018-05-14.
How severe is CVE-2018-10989?: Medium severity. CVSS v3 base score is 6.6 out of 10.