CVE-2017-14116: Critical severity att u-verse firmware vulnerability
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 and then installing new software, such as BusyBox with "nc -l" support.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14116?
CVE-2017-14116 has a common vulnerability scoring system (CVSS) rating that indicates a high risk due to the potential for remote code execution.
How do I fix CVE-2017-14116?
To fix CVE-2017-14116, it is recommended to change the default settings of the AT&T U-verse device, particularly securing WAN access and updating firmware if an update is available.
What devices are affected by CVE-2017-14116?
CVE-2017-14116 affects the AT&T U-verse devices running firmware version 9.2.2h0d83.
What exploit technique is used in CVE-2017-14116?
CVE-2017-14116 exploits a misconfiguration that allows attackers to gain root privileges via a vulnerable HTTPS service.
Is CVE-2017-14116 actively being exploited?
As of the latest data, there have been reports of exploitation attempts targeting devices vulnerable to CVE-2017-14116.