CVE-2018-10989

Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by leveraging access to the local network. NOTE: one or more user's guides distributed by ISPs state "At a minimum, you should set a login password."

CVSS v3 6.6 MEDIUM
CVSS v2.0 3.5 LOW

6.6^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.7 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://medium.com/%40AkshaySharmaUS/comcast-arris-touchstone-gateway-devices-are-vulnerable-heres-the-disclosure-7d603aa9342c

Configurations

Configuration 1 (hide)

AND

cpe:2.3:h:commscope:arris_tg1682g:-:*:*:*:*:*:*:*

cpe:2.3:o:commscope:arris_tg1682g_firmware:9.1.103j6:*:*:*:*:*:*:*

History

No history.

Information

Published : 2018-05-14 14:29

Updated : 2023-11-07 02:51

NVD link : CVE-2018-10989

Mitre link : CVE-2018-10989

CVE.ORG link : CVE-2018-10989

JSON object : View

Products Affected

commscope

arris_tg1682g_firmware
arris_tg1682g

CWE

CWE-1188

Initialization of a Resource with an Insecure Default

{"id": "CVE-2018-10989", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.6, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.7}]}, "published": "2018-05-14T14:29:00.287", "references": [{"url": "https://medium.com/%40AkshaySharmaUS/comcast-arris-touchstone-gateway-devices-are-vulnerable-heres-the-disclosure-7d603aa9342c", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-1188"}]}], "descriptions": [{"lang": "en", "value": "Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of \"password\" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by leveraging access to the local network. NOTE: one or more user's guides distributed by ISPs state \"At a minimum, you should set a login password.\""}, {"lang": "es", "value": "Algunos ISP distribuyen los dispositivos Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 con la contrase\u00f1a \"password\" por defecto para la cuenta de administraci\u00f3n que se utiliza en una conexi\u00f3n sin cifrar en http://192.168.0.1, lo que permite que los atacantes remotos omitan las restricciones de acceso al acceder a la red local. NOTA: una o m\u00e1s gu\u00edas de usuario distribuidas por ISP declaran \"Como m\u00ednimo, deber\u00eda establecer una contrase\u00f1a de inicio de sesi\u00f3n\"."}], "lastModified": "2023-11-07T02:51:35.983", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:commscope:arris_tg1682g:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "5D2AFAD9-07CD-4960-801F-A602CB31BD61"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:commscope:arris_tg1682g_firmware:9.1.103j6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B89139C7-E762-4F5F-A6AD-CC67CFC96136"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}