VDB
CVE-2026-16771
CVE-2026-16771
PUBLISHED
CVSS 8.8 HIGH
Reported by certcc · Published July 28, 2026
In firmware versions 2.7.7 and earlier, the Arris BGW210‑700 gateway fails to enforce any server‑side authentication on its /cgi-bin/*.ha management endpoints, relying solely on client‑side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the LAN to read sensitive configuration data, modify persistent device settings, or trigger backend diagnostic operations. The issue appears systemic across the CGI handler chain.
Risk Scores
CVSS 3.1
8.8
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| AT&T | Arris BGW210‑700 | 0 |
| AT&T | Arris BGW210‑700 | 0 |
Timeline
- Jul 28, 2026 CVE Published
- Jul 28, 2026 CVE Updated
- Jul 29, 2026 Coalition ESS Score
- Aug 7, 2026 EPSS Score