Auth bypass in Adtran 834-5
CVE-2024-31970
AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the Internet. During a window of time when the device is being set up, it uses a default username and password combination of admin/admin with root-level privileges. An attacker can exploit this window to gain unauthorized root access by either modifying the existing admin account or creating a new account with equivalent privileges. This vulnerability allows attackers to execute arbitrary commands. NOTE: The vendor has disputed this, finding the report not applicable. According to AdTran, SSH has never been accessible (from WAN) on SmartOS official builds. Furthermore, the vendor adds that test build 11.1.0.101-202106231430 was never released to end users.
Vulnerability class: Broken Access Control
EPSS: 0.006 (45.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Adtran 834-5
- Adtran Sdg_smartos
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Broken Link)
- cve@mitre.org (Third Party Advisory)
- cve@mitre.org
Frequently asked questions
- What is CVE-2024-31970?
- CVE-2024-31970 is a high-severity vulnerability in Adtran 834-5, classified under Incorrect Authorization. CVSS score: 8.8/10. Published 2024-07-24.
- How severe is CVE-2024-31970?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2024-31970 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.