CVE-2017-14117: att u-verse_firmware Improper Authentication
Vulnerability summary
CVE-2017-14117 is a medium (CVSS 5.9) Improper Authentication vulnerability in att u-verse_firmware. EPSS estimates a 8.02% chance of exploitation in the next 30 days, higher than 94.7% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 03-09-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures an unauthenticated proxy service on WAN TCP port 49152, which allows remote attackers to establish arbitrary TCP connections to intranet hosts by sending \x2a\xce\x01 followed by other predictable values.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
8.02%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 8.02% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundExploit Reference (nomotion.net)
Maturity: unknown
Open WAN-to-LAN proxy on AT&T routers
auxiliary/scanner/wproxy/att_open_proxy
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Att1 product
- u-verse_firmware9.2.2h0d83
1 vendor · 1 product
References
3 links- threatpost.com/bugs-in-arris-modems-distributed-by-att-vulnerable-to-trivial-attacks/127753/X Refsource MISCThird Party Advisory
- www.nomotion.net/blog/sharknatto/X Refsource MISCExploitMitigationTechnical DescriptionThird Party Advisory