CVE-2024-31970
Severity:
HIGH
Type:
Unavailable / Other
Publication date:
24/07/2024
Last modified:
01/08/2024
Description
AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the Internet. During a window of time when the device is being set up, it uses a default username and password combination of admin/admin with root-level privileges. An attacker can exploit this window to gain unauthorized root access by either modifying the existing admin account or creating a new account with equivalent privileges. This vulnerability allows attackers to execute arbitrary commands.
Impact
Base Score 3.x
8.80
Severity 3.x
HIGH
Vulnerable products and versions
CPE | From | Up to |
---|---|---|
cpe:2.3:o:adtran:sdg_smartos:*:*:*:*:*:*:*:* | 12.1.3.1 (excluding) | |
cpe:2.3:h:adtran:834-5:-:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page