CVE-2026-16771

{
  "id": "CVE-2026-16771",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-28T19:17:32.247",
  "lastModified": "2026-10-23T23:10:00.157",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/*.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the LAN to read sensitive configuration data, modify persistent device settings, or trigger backend diagnostic operations. The issue appears systemic across the CGI handler chain."
    },
    {
      "lang": "es",
      "value": "En las versiones de firmware 2.7.7 y anteriores, el gateway Arris BGW210?700 no aplica ninguna autenticación del lado del servidor en sus puntos finales de gestión /cgi-bin/*.ha, confiando únicamente en la restricción CSS/JavaScript del lado del cliente que puede ser eludida por cualquier cliente HTTP. Esto permite a atacantes no autenticados en la LAN leer datos de configuración sensibles, modificar configuraciones persistentes del dispositivo o activar operaciones de diagnóstico de backend. El problema parece sistémico en toda la cadena de gestores CGI."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "AT&T",
          "product": "Arris BGW210‑700",
          "versions": [
            {
              "version": "0",
              "lessThanOrEqual": "2.7.7",
              "versionType": "custom",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "attackVector": "ADJACENT_NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-28T18:58:28.079223Z",
          "id": "CVE-2026-16771",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-306"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://kb.cert.org/vuls/id/141367",
      "source": "[email protected]"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/141367",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ]
}