CVE-2017-10793: att u-verse_firmware
Vulnerability summary
CVE-2017-10793 is a high (CVSS 8.1) vulnerability in att u-verse_firmware. EPSS estimates a 2.78% chance of exploitation in the next 30 days, higher than 86.1% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 03-09-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and unspecified other devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password, which allows remote attackers to obtain sensitive information (such as the Wi-Fi password) by leveraging knowledge of a hardware identifier, related to the Bulk Data Collection (BDC) mechanism defined in Broadband Forum technical reports.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
2.78%
Chance of exploitation in the next 30 days
Percentile
86%
Versus all other CVEs
30-day change
0.00 pp
From 2.78% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (nomotion.net)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Att1 product
- u-verse_firmware9.2.2h0d83
1 vendor · 1 product
References
3 links- threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753/X Refsource MISCThird Party Advisory
- www.nomotion.net/blog/sharknatto/X Refsource MISCExploitMitigationTechnical DescriptionThird Party Advisory