CVE-2018-20386

ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and…

published December 23, 2018

CVSS
—
EPSS
2%
Percentile
78.6
In the wild
Unconfirmed
What it is

⚠️ A couple of crafty SNMP requests can expose sensitive credentials from your ARRIS SBG6580-2 device! Think of it like leaving your mailbox unlocked — a determined mailman could peek inside and learn all your secrets without even needing to break in. This vulnerability allows attackers to easily query your device and uncover sensitive information like credentials. If exploited, an attacker could potentially access your router's credentials, enabling unauthorized access to your network. This could lead to further network infiltration or even control over your internet connection, posing a significant risk to your personal information.

Put simply

Think of it like leaving your mailbox unlocked — a determined mailman could peek inside and learn all your secrets without even needing to break in. This vulnerability allows attackers to easily query your device and uncover sensitive information like credentials. This vulnerability arises from insufficient access controls in the SNMP protocol on ARRIS SBG6580-2 devices, allowing remote attackers to read sensitive OIDs and discover credential information.

What to do

If exploited, an attacker could potentially access your router's credentials, enabling unauthorized access to your network. This could lead to further network infiltration or even control over your internet connection, posing a significant risk to your personal information. To secure your device, disable SNMP if it's not in use, change default credentials, and ensure that firmware is updated to the latest version. Regularly review your network security settings to maintain a strong defense. You've got this! Taking these steps will help fortify your network against potential threats. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01823 · 78.6th percentile
Published
2018-12-23T21:00Z
EPSS history
Timeline
  • 23 DEC 21:00Z
    ARRIS SBG6580-2 D30GW-SEAEAGLE-1.5.2.5-GA-00-NOSH devices allow remote attackers to discover credentials via iso.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 and…
    cvelistv5