PT-2026-44402 · Sdmc · Ne6037

Ivan Racic + 1 · Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-24444

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SDMC NE6037 version 7.1.6.0.25 SDMC NE6037 version 7.1.6.1.9 B9

Description The web management interface recovery endpoints "mgmt.php" and "npcmd.php" contain a hardcoded password. Unauthenticated attackers can gain root access by submitting these hardcoded credentials to the recovery endpoints via HTTP. This access allows attackers to enable filtered SSH and Telnet services, resulting in unauthenticated root-level remote access to the underlying system.

Recommendations Update version 7.1.6.0.25 to a newer version that removes the hardcoded credentials. Update version 7.1.6.1.9 B9 to a newer version that removes the hardcoded credentials.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2026-24444

Affected Products

Ne6037

References · 4

• 🔥 https://kr3bz.wtf/posts/sdmc-ne6037-router-recovery-backdoor · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-24444 · Security Note
• https://en.sdmctech.com/product/DOCSIS_234.html · Note
• https://twitter.com/OrizonCyber/status/2060058587381027001 · Twitter Post