PT-2023-27229 · Arris · Arris Dg860A+1

Edward Warren · Published 2023-12-27 · Updated 2024-01-04 · CVE-2023-40038

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Arris DG860A (affected versions not specified) Arris DG1670A (affected versions not specified)

Description The devices have predictable default WPA2 PSKs, which could lead to unauthorized remote access. They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last digit.

Recommendations For Arris DG860A, change the default WPA2 PSK to a unique and strong password. For Arris DG1670A, change the default WPA2 PSK to a unique and strong password. As a temporary workaround, consider changing the SSID and BSSID to make it harder for attackers to predict the default WPA2 PSK.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-40038

Affected Products

Arris Dg1670A

Arris Dg860A

References · 7

• 🔥 https://github.com/actuator/cve/blob/main/Arris/CVE-2023-40038 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-40038 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40038 · Vendor Advisory
• https://i.ebayimg.com/images/g/ByAAAOSwQCFi2b50/s-l1600.jpg · Note
• https://t.me/cvenotify/65273 · Telegram Post
• https://twitter.com/CVEnew/status/1740106954721157159 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1740123783774490990 · Twitter Post