AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the Internet. During a window of time when the device is being set up, it uses a default username and password combination of admin/admin with root-level privileges. An attacker can exploit this window to gain unauthorized root access by either modifying the existing admin account or creating a new account with equivalent privileges. This vulnerability allows attackers to execute arbitrary commands. NOTE: The vendor has disputed this, finding the report not applicable. According to AdTran, SSH has never been accessible (from WAN) on SmartOS official builds. Furthermore, the vendor adds that test build 11.1.0.101-202106231430 was never released to end users.
References
Configurations
Configuration 1 (hide)
AND |
|
History
03 Sep 2024, 21:15
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Summary | (en) AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the Internet. During a window of time when the device is being set up, it uses a default username and password combination of admin/admin with root-level privileges. An attacker can exploit this window to gain unauthorized root access by either modifying the existing admin account or creating a new account with equivalent privileges. This vulnerability allows attackers to execute arbitrary commands. NOTE: The vendor has disputed this, finding the report not applicable. According to AdTran, SSH has never been accessible (from WAN) on SmartOS official builds. Furthermore, the vendor adds that test build 11.1.0.101-202106231430 was never released to end users. |
01 Aug 2024, 13:51
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-863 | |
Summary |
|
25 Jul 2024, 17:46
Type | Values Removed | Values Added |
---|---|---|
CWE | NVD-CWE-noinfo | |
CPE | cpe:2.3:h:adtran:834-5:-:*:*:*:*:*:*:* cpe:2.3:o:adtran:sdg_smartos:*:*:*:*:*:*:*:* |
|
First Time |
Adtran
Adtran 834-5 Adtran sdg Smartos |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
References | () https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31970 - Third Party Advisory | |
References | () https://github.com/actuator/cve/blob/main/AdTran/SRG-834-5 - Broken Link |
24 Jul 2024, 16:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2024-07-24 16:15
Updated : 2024-09-03 21:15
NVD link : CVE-2024-31970
Mitre link : CVE-2024-31970
CVE.ORG link : CVE-2024-31970
JSON object : View
Products Affected
adtran
- sdg_smartos
- 834-5
CWE