CWE Code: 798
Vulnerability Type: privilege_escalation
CVSS Score: 9.3
CWE Name:  Use of Hard-coded Credentials
Summary: the at&t u-verse 9.2.2h0d83 firmware for the arris nvg599 device, when ip passthrough mode is not used, configures wan access to a caserver https service with the tech account and an empty password, which allows remote attackers to obtain root privileges by establishing a session on port 49955 and then installing new software, such as busybox with "nc -l" support.
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-09-03
Last Modified Date: 2017-09-13