EUVD-2026-32928
GHSA-cg6m-frf7-6623
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessScan ISP ranges for NE6037 mgmt interface
-
DeliveryPOST hardcoded credential to mgmt.php/npcmd.php
-
ExploitRecovery endpoint enables SSH/Telnet daemons
-
ExecutionConnect to device as root
-
PersistEstablish persistence on CPE
-
ImpactPivot into subscriber LAN or join botnet
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Credential externalization
MITRE ATT&CK
2 techniques across 2 tactics: Persistence, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The vulnerable device must be one of the two listed NE6037 firmware builds (7.1.6.0.25 or 7.1.6.1.9_B9) and the HTTP web management interface must be network-reachable by the attacker; no authentication, no user interaction, and no non-default configuration changes are required because the hardcoded credential is shipped in the firmware and the recovery endpoints (mgmt.php, npcmd.php) are present by default. The principal limiting factor is network reachability of the management interface - in ISP deployments that bind it to a provisioning-only management VLAN or block WAN-side access, exploitation is constrained to attackers already on the LAN or on the provisioning network; on units exposed to the WAN, no further limits apply. |
| Impact | Multiple signals point to high real-world risk. The CVSS 9.8 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable, low-complexity, unauthenticated exploitation with full CIA impact, which is consistent with the described HTTP-based recovery backdoor. Publicly available exploit code (per VulnCheck and the kr3bz.wtf write-up) lowers the bar for opportunistic attackers and worm-style automation. The vulnerability is not currently listed in CISA KEV and no EPSS or SSVC values were provided in the input - exploitation status in the wild therefore cannot be confirmed from the data given, only that weaponized public PoC exists. The realistic blast radius depends on whether the web management interface is exposed to the WAN side or restricted to the LAN by the ISP's provisioning configuration; CPE data does not disambiguate this, so defenders should treat any device reachable from untrusted networks as critically exposed and assume identical risk across both listed firmware builds. |
| Exploit ScenarioDerived | An attacker scans a cable ISP's subscriber IP ranges for the NE6037 web management interface, then sends an HTTP request to mgmt.php or npcmd.php carrying the hardcoded credential - recoverable from the published PoC at kr3bz.wtf - to invoke the recovery action that enables SSH and Telnet. They then connect over SSH as root and use the device as a persistent foothold for traffic interception, lateral movement into the subscriber LAN, or enlistment in a router botnet. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 28, 2026
Unauthenticated remote root access on SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 is achievable by submitting a hardcoded credential to recovery endpoints (mgmt.php, npcmd.php) in the web management interface. Attackers can then enable filtered SSH/Telnet services to obtain persistent root-level shell access. CVSS is 9.8 with publicly available exploit code, though no public exploit identified at time of analysis in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis - the references include only the vendor product page and the third-party disclosure at https://www.kr3bz.wtf/posts/sdmc-ne6037-router-recovery-backdoor/, with no fixed firmware version cited. Operators (typically ISPs managing these as CPE) should contact SDMC for a firmware build that removes the hardcoded credential and rotates any shared secrets, and in the meantime apply compensating controls: block inbound TCP to the HTTP/HTTPS management interface from the WAN at the upstream CMTS or edge ACL, restrict the management VLAN to ISP provisioning hosts only, and explicitly block SSH (TCP/22) and Telnet (TCP/23) inbound to subscriber devices since those are the persistence channels the attacker enables post-exploit; the trade-off is loss of any legitimate remote management workflows that rely on those ports. If feasible, swap affected units for non-vulnerable CPE models, as a backdoor credential cannot be remediated by configuration on the device itself.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The NE6037 is a DOCSIS cable modem/router gateway manufactured by SDMC Technology Co., Ltd (per vendor product page en.sdmctech.com/product/DOCSIS_234.html), typically deployed by ISPs as customer premises equipment. The vulnerable web management interface is implemented in PHP (per tags), and the flaw resides in two recovery endpoints - mgmt.php and npcmd.php - that accept a hardcoded credential baked into the firmware. This is a textbook CWE-798 (Use of Hard-coded Credentials) issue: a static secret embedded in shipped firmware images cannot be rotated by the operator, so once the value is recovered from one device it is universally valid across all units running the affected firmware builds. The hardcoded credential gates a privileged recovery path that can toggle SSH and Telnet daemons on the underlying Linux-based router OS, yielding root-level shell access.
Know when Ne6037 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Primary rating from Vendor (VulnCheck) · only source for this CVE.
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
1DescriptionCVE.org
SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints (mgmt.php, npcmd.php) that allows unauthenticated attackers to gain root access by submitting the hardcoded credential to the recovery endpoint via HTTP. Attackers can leverage this hardcoded password to enable filtered SSH and Telnet services on the device, resulting in unauthenticated root-level remote access to the underlying system.
Executive ViewAI
SDMC NE6037 cable modem routers (firmware versions 7.1.6.0.25 and 7.1.6.1.9_B9) are vulnerable to unauthenticated remote root compromise through hardcoded credentials in recovery endpoints, allowing attackers persistent shell access to network perimeter equipment. This CRITICAL vulnerability (CVSS 9.8) directly threatens ISPs and organizations deploying this equipment as internet-facing infrastructure, with publicly available exploit code and no vendor patch currently available. Immediate containment is essential to prevent lateral movement into customer or corporate networks.
Restrict network access to recovery endpoints (mgmt.php, npcmd.php) via firewall ACLs; disable or isolate web management interface; implement network segmentation to contain affected modems; deploy IDS/IPS rules to detect hardcoded credential submission attempts; monitor SSH/Telnet service enablement on affected devices; establish replacement timeline with alternative modem vendors.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB