Arris Bgw210 700
Monthly
Unauthenticated configuration manipulation and information disclosure in Arris BGW210‑700 gateways running firmware 2.7.7 and earlier arises because the server fails to enforce authentication on /cgi-bin/*.ha management endpoints, relying only on client‑side JavaScript gating. Any LAN‑adjacent attacker can read sensitive configuration data, modify persistent device settings, or invoke diagnostic operations. No active exploitation or public proof‑of‑concept is known, but the missing server‑side checks make exploitation trivial once network adjacency is gained.
Unauthenticated configuration manipulation and information disclosure in Arris BGW210‑700 gateways running firmware 2.7.7 and earlier arises because the server fails to enforce authentication on /cgi-bin/*.ha management endpoints, relying only on client‑side JavaScript gating. Any LAN‑adjacent attacker can read sensitive configuration data, modify persistent device settings, or invoke diagnostic operations. No active exploitation or public proof‑of‑concept is known, but the missing server‑side checks make exploitation trivial once network adjacency is gained.