What is CVE-2026-16771?

CVE-2026-16771 is a high-severity vulnerability in At&t Arris Bgw210‑700, classified under Missing Authentication for Critical Function. CVSS score: 8.8/10. Published 2026-07-28.

How severe is CVE-2026-16771?

High severity. CVSS v3 base score is 8.8 out of 10.

Auth bypass in At&t Arris Bgw210‑700

CVE-2026-16771

In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/*.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the LAN to read sensitive configuration data, modify persistent device settings, or trigger backend diagnostic operations. The issue appears systemic across the CGI handler chain.

Vulnerability class: Broken Authentication

EPSS: 0.004 (28.4th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

At&t Arris Bgw210‑700 — versions 0

Weakness classification (CWE)

CWE-306 — Missing Authentication for Critical Function

References

Frequently asked questions

What is CVE-2026-16771?: CVE-2026-16771 is a high-severity vulnerability in At&t Arris Bgw210‑700, classified under Missing Authentication for Critical Function. CVSS score: 8.8/10. Published 2026-07-28.
How severe is CVE-2026-16771?: High severity. CVSS v3 base score is 8.8 out of 10.