CISA issues notice on authentication bypass in ARRIS BGW210-700 LAN management interface

Firmware versions 2.7.7 and earlier of the ARRIS BGW210-700 residential gateway contain an authentication bypass vulnerability, tracked as CVE-2026-16771, that allows any unauthenticated LAN-side user to read sensitive configuration data and modify device settings through web management endpoints.

The Arris BGW210-700 is a residential gateway used in AT&T deployments for routing, wireless networking, and wide-area network (WAN) connectivity. The device exposes a browser-based management interface on the local-area network (LAN) side for configuring WiFi settings, checking diagnostics, and running system operations. Several CGI handlers in the web interface do not enforce server-side authentication checks; an “Access Code” prompt is implemented through client-side HTML and JavaScript and is not validated by the server before processing requests, so an HTTP client that ignores client-side code can access underlying CGI endpoints. The wconfig_unified.ha endpoint returns the plaintext WiFi pre-shared key for all configured SSIDs to unauthenticated requesters. The broadbandconfig.ha endpoint accepts unauthenticated POST requests that modify WAN configuration parameters, including settings that persist across device reboots. Diagnostic endpoints such as diag.ha allow unauthenticated triggering of backend diagnostic jobs.

This vulnerability allows any unauthenticated user on the LAN, including devices connected through the main WiFi network, Guest WiFi network, or LAN ethernet, to read sensitive configuration information and make persistent changes to gateway settings. A local attacker can retrieve the network’s plaintext WiFi password with a single HTTP request and achieve unauthorized access to manipulate, intrude on, and interfere with protected networks.

The gateway is ISP-managed, and all standard internet-connected devices are expected to have been automatically updated to newer unaffected versions. Users can determine their active version by checking router diagnostic settings via web browser and may contact their ISP to confirm that automatic updates are functioning correctly. The vulnerability is limited to the LAN-side management interface, and isolating untrusted devices, keeping IoT systems updated, and monitoring for the presence of unknown clients are described as reducing risk in environments where older firmware may still be present.

Thanks to David Weekly for researching and reporting this vulnerability. The document was written by Molly Jaconski.

Source: kb.cert.org, by Molly Jaconski.