Gwn7660Elr
Monthly
Unauthenticated remote attackers can query the SNMP v2c service on Grandstream GWN7660ELR access points running firmware before 1.0.27.6 when the service is left with the factory-default community string 'public', harvesting system metadata such as OS and kernel versions, process names and command-line arguments, interface configuration, routing and ARP tables, active TCP connections, and filesystem paths. The CVSS 4.0 base score is 6.9 (vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) and our independent assessment maps it to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - a read-only reconnaissance issue requiring only UDP/161 reachability, with no write, code execution, or lateral-movement primitive on its own. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but modest-priority information-disclosure weakness whose real-world exposure depends on whether SNMP is enabled, still using the default community string, and reachable from untrusted networks; it is fixed in firmware 1.0.27.6.
Unauthenticated remote attackers can query the SNMP v2c service on Grandstream GWN7660ELR access points running firmware before 1.0.27.6 when the service is left with the factory-default community string 'public', harvesting system metadata such as OS and kernel versions, process names and command-line arguments, interface configuration, routing and ARP tables, active TCP connections, and filesystem paths. The CVSS 4.0 base score is 6.9 (vector CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) and our independent assessment maps it to CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - a read-only reconnaissance issue requiring only UDP/161 reachability, with no write, code execution, or lateral-movement primitive on its own. No public exploit code has been identified at time of analysis and the CVE is not in CISA KEV, so this is a genuine but modest-priority information-disclosure weakness whose real-world exposure depends on whether SNMP is enabled, still using the default community string, and reachable from untrusted networks; it is fixed in firmware 1.0.27.6.