CWE Code: 798
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Use of Hard-coded Credentials
Summary: the at&t u-verse 9.2.2h0d83 firmware for the arris nvg589 and nvg599 devices, when ip passthrough mode is not used, configures ssh-permanent-enable wan ssh logins to the remotessh account with the 5sap9i26 password, which allows remote attackers to access a "terminal shell v1.0" service, and subsequently obtain unrestricted root privileges, by establishing an ssh session and then entering certain shell metacharacters and busybox commands.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-09-03
Last Modified Date: 2019-10-03