CVE-2018-10989 — MEDIUM (6.6)

Vulnerability Description

Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0.1 connection, which might allow remote attackers to bypass intended access restrictions by leveraging access to the local network. NOTE: one or more user's guides distributed by ISPs state "At a minimum, you should set a login password."

CVSS Score

6.6

MEDIUM

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

HIGH

Affected Products

Vendor	Product	Versions
Commscope	Arris Tg1682G Firmware	9.1.103j6
Commscope	Arris Tg1682G	-

Related Weaknesses (CWE)

CWE-1188

References

FAQ

What is CVE-2018-10989?

CVE-2018-10989 is a vulnerability with a CVSS score of 6.6 (MEDIUM). Arris Touchstone Telephony Gateway TG1682G 9.1.103J6 devices are distributed by some ISPs with a default password of "password" for the admin account that is used over an unencrypted http://192.168.0....

How severe is CVE-2018-10989?

CVE-2018-10989 has been rated MEDIUM with a CVSS base score of 6.6/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-10989?

Check the references section above for vendor advisories and patch information. Affected products include: Commscope Arris Tg1682G Firmware, Commscope Arris Tg1682G.