CVE-2024-23618CWE-306

Arris SURFboard SBG6950AC2 Arbitrary Code Execution Vulnerability

Critical · published January 25, 2024

CVSS v3.1
9.6
EPSS
1%
Percentile
68.2
In the wild
Unconfirmed
What it is

🔥 An unauthenticated attacker can execute code as root on Arris SURFboard SGB6950AC2 devices — it's like leaving the front door wide open with a welcome mat for hackers! Think of this vulnerability like a hotel where anyone can walk into any room without a keycard — once they're in, they can do whatever they want. This open access allows malicious actors to take control of the device and execute harmful commands. An attacker could gain full control over the device, potentially compromising the network it's connected to. This could lead to data theft, unauthorized monitoring, or even using the device as a launching pad for further attacks. The consequences could be absolutely devastating!

Put simply

Think of this vulnerability like a hotel where anyone can walk into any room without a keycard — once they're in, they can do whatever they want. This open access allows malicious actors to take control of the device and execute harmful commands. This vulnerability allows arbitrary code execution due to insufficient authentication checks in the Arris SURFboard SGB6950AC2 devices. An attacker can exploit this flaw to run malicious code with root privileges, taking over the device completely.

What to do

An attacker could gain full control over the device, potentially compromising the network it's connected to. This could lead to data theft, unauthorized monitoring, or even using the device as a launching pad for further attacks. The consequences could be absolutely devastating! Immediately patch the affected devices to the latest firmware version as soon as it’s available. Ensure that any default credentials are changed and consider implementing additional network security measures, such as firewalls or access control lists. Don't wait! 🔥 You've got this! By taking action now, you can safeguard your network and secure those devices. 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01210 · 68.2th percentile
Weakness
CWE-306 · Missing Authentication for Critical Function
Published
2024-01-25T23:35Z
EPSS history
Timeline
  • 25 JAN 23:35Z
    Arris SURFboard SBG6950AC2 Arbitrary Code Execution Vulnerability
    cvelistv5