CVE-2023-40038

HIGH

Arris Dg860a Firmware - Authentication Bypass

Title source: rule

Description

Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last digit.)

References (2)

Core 2

Core References

Third Party Advisory

https://github.com/actuator/cve/blob/main/Arris/CVE-2023-40038

View Writeup ZIP pw:eip

Product

https://i.ebayimg.com/images/g/ByAAAOSwQCFi2b50/s-l1600.jpg

Scores

CVSS v3 8.8

EPSS 0.0006

EPSS Percentile 17.9%

Attack Vector ADJACENT_NETWORK

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287

Status published

Products (2)

arris/dg1670a_firmware ts0901203b6_020420_16xx.gw_pc20_tw

arris/dg860a_firmware

Published Dec 27, 2023

Tracked Since Feb 18, 2026