« Volver al listado

CVE-2015-2904

Estado: ModificadaAlta (8.3)—

Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Actiontec — Ncs01 Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2015-2904",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 8.3,
          "accessVector": "ADJACENT_NETWORK",
          "vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.5,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cret@cert.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2015-08-23T21:59:00.120",
  "references": [
    {
      "url": "http://www.kb.cert.org/vuls/id/335192",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "cret@cert.org"
    },
    {
      "url": "http://www.kb.cert.org/vuls/id/335192",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad en módems Actiontec GT784WN con firmware anterior a NCS01-1.0.13, tienen credenciales embebidos, lo que hace que sea más fácil para atacantes remotos obtener acceso root mediante la conexión a la interfaz web de administración."
    }
  ],
  "lastModified": "2026-06-17T00:24:56.903",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:actiontec:_ncs01_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "749C0338-915B-452D-BCF2-525D92BEE4CD",
              "versionEndIncluding": "1.0.12"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:actiontec:gt784wn_wireless_n_dsl_modem:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "09E73619-EE42-443C-A1F0-E3D2474D5590"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "evaluatorComment": "<a href=\"http://cwe.mitre.org/data/definitions/798.html\" target=\"_blank\">CWE-798: Use of Hard-coded Credentials</a>",
  "sourceIdentifier": "cret@cert.org"
}