CVE-2023-40038 - Vulnerability Details - OpenCVE

ReportizFlow

Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last digit.)

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Arris	Dg1670a Dg1670a Firmware Dg860a Dg860a Firmware

Configuration 1 [-]

AND

cpe:2.3:o:arris:dg860a_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:arris:dg860a:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND

cpe:2.3:o:arris:dg1670a_firmware:ts0901203b6_020420_16xx.gw_pc20_tw:*:*:*:*:*:*:*

cpe:2.3:h:arris:dg1670a:-:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/actuator/cve/blob/main/Arris/CVE-2023-40038
https://i.ebayimg.com/images/g/ByAAAOSwQCFi2b50/s-l1600.jpg

History

No history.

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-12-27T00:00:00.000Z

Updated: 2024-08-02T18:24:54.678Z

Reserved: 2023-08-08T00:00:00.000Z

Link: CVE-2023-40038

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-12-27T20:15:19.230

Modified: 2026-06-17T06:15:53.070

Link: CVE-2023-40038

Redhat

No data.

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "[email protected]"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:arris:dg860a_firmware:-:*:*:*:*:*:*:*", "matchCriteriaId": "2B0F8212-DAB2-4A13-9268-2201EF2AB1F3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:arris:dg860a:-:*:*:*:*:*:*:*", "matchCriteriaId": "244A5CC6-DA00-4E1D-AECD-4E446E6FE9E8", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:arris:dg1670a_firmware:ts0901203b6_020420_16xx.gw_pc20_tw:*:*:*:*:*:*:*", "matchCriteriaId": "CEC53589-0DA8-4342-B2FE-520B8D1CDF3A", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:arris:dg1670a:-:*:*:*:*:*:*:*", "matchCriteriaId": "FD31D71D-6794-4497-ADB6-389BF0771147", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last digit.)"}, {"lang": "es", "value": "Los dispositivos Arris DG860A y DG1670A tienen PSK WPA2 predeterminados predecibles que podr\u00edan provocar un acceso remoto no autorizado. (Usan los primeros 6 caracteres del SSID y los \u00faltimos 6 caracteres del BSSID, disminuyendo el \u00faltimo d\u00edgito)."}], "id": "CVE-2023-40038", "lastModified": "2026-06-17T06:15:53.070", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-12-27T20:15:19.230", "references": [{"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://github.com/actuator/cve/blob/main/Arris/CVE-2023-40038"}, {"source": "[email protected]", "tags": ["Product"], "url": "https://i.ebayimg.com/images/g/ByAAAOSwQCFi2b50/s-l1600.jpg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://github.com/actuator/cve/blob/main/Arris/CVE-2023-40038"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://i.ebayimg.com/images/g/ByAAAOSwQCFi2b50/s-l1600.jpg"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "[email protected]", "type": "Primary"}]}