by Kastro
Paper/Archive/CVE-2024-23618

CVE-2024-23618

Arris SURFboard SBG6950AC2 — Arris SURFboard SBG6950AC2 Arbitrary Code Execution Vulnerability

EPSS 1%CVSS 9.8
critical.is priorityof 100
43
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 68.4.684 × 2013.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

An arbitrary code execution vulnerability exists in Arris SURFboard SGB6950AC2 devices. An unauthenticated attacker can exploit this vulnerability to achieve code execution as root.

Affected

ProductAffectedFixed inSource
SURFboard SBG6950AC29.1.103aa23–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
XI (CNA)9.6CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

writeupblog.exodusintel.com/2024/01/25/arris-surfboard-sbg6950ac2-arbitrary-command-execution-vulnerability