Which versions of SDMC NE6037 are affected by EUVD-2026-32928?

SDMC NE6037 cable modem routers (firmware versions 7.1.6.0.25 and 7.1.6.1.9_B9) are vulnerable to unauthenticated remote root compromise through hardcoded credentials in recovery endpoints, allowing…

Is there a public PoC exploit available for EUVD-2026-32928?

Yes, a public proof-of-concept exploit is available for EUVD-2026-32928. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate EUVD-2026-32928?

Within 24 hours: Scan all networks to identify SDMC NE6037 devices running firmware 7.1.6.0.25 or 7.1.6.1.9_B9; document inventory and network placement. Within 7 days: Restrict access to mgmt.php and npcmd.php endpoints via firewall rules or WAF, disable HTTP/HTTPS management interface where operationally feasible, or limit administrative access to hardened bastion hosts only; implement network segmentation isolating affected devices from critical infrastructure and customer networks. Within 30 days: Contact SDMC for patch timeline and interim mitigation guidance, or initiate procurement for replacement modem models with active vendor support.

SDMC NE6037 EUVD-2026-32928

Q: What is the CVSS score of EUVD-2026-32928?

EUVD-2026-32928 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

| CVE-2026-24444 CRITICAL

Use of Hard-coded Credentials (CWE-798)

2026-05-28 VulnCheck

GHSA-cg6m-frf7-6623

PHP Authentication Bypass

9.3

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

May 28, 2026 - 17:22 vuln.today

cvss_changed

CVSS changed

May 28, 2026 - 17:22 NVD

9.8 (CRITICAL) 9.3 (CRITICAL)

Analysis Generated

May 28, 2026 - 17:21 vuln.today

DescriptionCVE.org

SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery endpoints (mgmt.php, npcmd.php) that allows unauthenticated attackers to gain root access by submitting the hardcoded credential to the recovery endpoint via HTTP. Attackers can leverage this hardcoded password to enable filtered SSH and Telnet services on the device, resulting in unauthenticated root-level remote access to the underlying system.

AnalysisAI

Unauthenticated remote root access on SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 is achievable by submitting a hardcoded credential to recovery endpoints (mgmt.php, npcmd.php) in the web management interface. Attackers can then enable filtered SSH/Telnet services to obtain persistent root-level shell access. CVSS is 9.8 with publicly available exploit code, though no public exploit identified at time of analysis in CISA KEV.

Technical ContextAI

The NE6037 is a DOCSIS cable modem/router gateway manufactured by SDMC Technology Co., Ltd (per vendor product page en.sdmctech.com/product/DOCSIS_234.html), typically deployed by ISPs as customer premises equipment. The vulnerable web management interface is implemented in PHP (per tags), and the flaw resides in two recovery endpoints - mgmt.php and npcmd.php - that accept a hardcoded credential baked into the firmware. This is a textbook CWE-798 (Use of Hard-coded Credentials) issue: a static secret embedded in shipped firmware images cannot be rotated by the operator, so once the value is recovered from one device it is universally valid across all units running the affected firmware builds. The hardcoded credential gates a privileged recovery path that can toggle SSH and Telnet daemons on the underlying Linux-based router OS, yielding root-level shell access.

RemediationAI

No vendor-released patch identified at time of analysis - the references include only the vendor product page and the third-party disclosure at https://www.kr3bz.wtf/posts/sdmc-ne6037-router-recovery-backdoor/, with no fixed firmware version cited. Operators (typically ISPs managing these as CPE) should contact SDMC for a firmware build that removes the hardcoded credential and rotates any shared secrets, and in the meantime apply compensating controls: block inbound TCP to the HTTP/HTTPS management interface from the WAN at the upstream CMTS or edge ACL, restrict the management VLAN to ISP provisioning hosts only, and explicitly block SSH (TCP/22) and Telnet (TCP/23) inbound to subscriber devices since those are the persistence channels the attacker enables post-exploit; the trade-off is loss of any legitimate remote management workflows that rely on those ports. If feasible, swap affected units for non-vulnerable CPE models, as a backdoor credential cannot be remediated by configuration on the device itself.