Skip to main content

CISA issues notice on authentication bypass in ARRIS BGW210-700 LAN management interface

Source Decision Insights Threat Desk Published August 23, 2026 Companies 3
Human View Machine View

3 companies named across 7 categories, the first article referencing ARRIS.

Companies mentioned

Best suited for

Seniority
Director
Job function
Cybersecurity / Information Security
Persona
Security Operations Leader
Buyer role
Decision Maker / Budget Holder
Decision stage
Post Buy
Adoption curve
Early Majority
Technology maturity
Market Correction
Industry
Telecommunication Services / Diversified Telecommunication Services / Integrated Telecommunication Services

Our classification, not the publisher's statement. Best suited for, not only for.

Firmware versions 2.7.7 and earlier of the ARRIS BGW210-700 residential gateway contain an authentication bypass vulnerability, tracked as CVE-2026-16771, that allows any unauthenticated LAN-side user to read sensitive configuration data and modify device settings through web management endpoints.

The Arris BGW210-700 is a residential gateway used in AT&T deployments for routing, wireless networking, and wide-area network (WAN) connectivity. The device exposes a browser-based management interface on the local-area network (LAN) side for configuring WiFi settings, checking diagnostics, and running system operations. Several CGI handlers in the web interface do not enforce server-side authentication checks; an “Access Code” prompt is implemented through client-side HTML and JavaScript and is not validated by the server before processing requests, so an HTTP client that ignores client-side code can access underlying CGI endpoints. The wconfig_unified.ha endpoint returns the plaintext WiFi pre-shared key for all configured SSIDs to unauthenticated requesters. The broadbandconfig.ha endpoint accepts unauthenticated POST requests that modify WAN configuration parameters, including settings that persist across device reboots. Diagnostic endpoints such as diag.ha allow unauthenticated triggering of backend diagnostic jobs.

This vulnerability allows any unauthenticated user on the LAN, including devices connected through the main WiFi network, Guest WiFi network, or LAN ethernet, to read sensitive configuration information and make persistent changes to gateway settings. A local attacker can retrieve the network’s plaintext WiFi password with a single HTTP request and achieve unauthorized access to manipulate, intrude on, and interfere with protected networks.

The gateway is ISP-managed, and all standard internet-connected devices are expected to have been automatically updated to newer unaffected versions. Users can determine their active version by checking router diagnostic settings via web browser and may contact their ISP to confirm that automatic updates are functioning correctly. The vulnerability is limited to the LAN-side management interface, and isolating untrusted devices, keeping IoT systems updated, and monitoring for the presence of unknown clients are described as reducing risk in environments where older firmware may still be present.

Thanks to David Weekly for researching and reporting this vulnerability. The document was written by Molly Jaconski.

Blog post, originally published by Molly Jaconski at kb.cert.org.

Mentions

Structured data (JSON-LD)

The schema.org markup this page publishes for search engines and AI agents, exactly as they read it.

[
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#website",
    "@type": "WebSite",
    "name": "Decision Insights",
    "potentialAction": {
      "@type": "SearchAction",
      "target": {
        "@type": "EntryPoint",
        "urlTemplate": "https://decisioninsights.ai/search/?q={search_term_string}&submit=1"
      }
    },
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    },
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/#organization",
    "@type": "Organization",
    "contactPoint": {
      "@type": "ContactPoint",
      "contactType": "customer support",
      "email": "[email protected]"
    },
    "description": "Decision Insights is a Registry of technology companies, open source projects, and industry terms, built for people and for AI agents that need sourced, structured information.",
    "logo": {
      "@type": "ImageObject",
      "url": "https://wiretap-cdn-assets.nyc3.cdn.digitaloceanspaces.com/decision-insights/[email protected]"
    },
    "name": "Decision Insights",
    "parentOrganization": {
      "@type": "Organization",
      "name": "Wiretap Labs",
      "sameAs": [
        "https://www.linkedin.com/company/wiretap-labs",
        "https://www.crunchbase.com/organization/wiretap-labs"
      ],
      "url": "https://wiretaplabs.com"
    },
    "publishingPrinciples": "https://decisioninsights.ai/standards/",
    "sameAs": [
      "https://www.linkedin.com/company/decisioninsights"
    ],
    "url": "https://decisioninsights.ai"
  },
  {
    "@context": "https://schema.org",
    "@type": "BreadcrumbList",
    "itemListElement": [
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai",
        "name": "Decision Insights",
        "position": 1
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/records/",
        "name": "Records",
        "position": 2
      },
      {
        "@type": "ListItem",
        "item": "https://decisioninsights.ai/cisa-issues-notice-on-authentication-bypass-in-arris-bgw210-700-lan-management-interface/",
        "name": "CISA issues notice on authentication bypass in ARRIS BGW210-700 LAN management interface",
        "position": 3
      }
    ]
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/cisa-issues-notice-on-authentication-bypass-in-arris-bgw210-700-lan-management-interface/#blogposting",
    "@type": "BlogPosting",
    "about": {
      "@id": "https://decisioninsights.ai/registry/commscope/arris/#organization",
      "@type": "Organization",
      "mainEntityOfPage": "https://decisioninsights.ai/registry/commscope/arris/",
      "name": "ARRIS"
    },
    "audience": [
      {
        "@type": "Audience",
        "additionalType": "Seniority",
        "audienceType": "Director"
      },
      {
        "@type": "Audience",
        "additionalType": "Job function",
        "audienceType": "Cybersecurity / Information Security"
      },
      {
        "@type": "Audience",
        "additionalType": "Persona",
        "audienceType": "Security Operations Leader"
      },
      {
        "@type": "Audience",
        "additionalType": "Buyer role",
        "audienceType": "Decision Maker / Budget Holder"
      },
      {
        "@type": "Audience",
        "additionalType": "Adoption curve",
        "audienceType": "Early Majority"
      },
      {
        "@type": "Audience",
        "additionalType": "Technology maturity",
        "audienceType": "Market Correction"
      },
      {
        "@type": "Audience",
        "additionalType": "Industry",
        "audienceType": "Telecommunication Services / Diversified Telecommunication Services / Integrated Telecommunication Services"
      }
    ],
    "author": {
      "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
      "@type": "Person",
      "name": "Decision Insights Threat Desk",
      "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
    },
    "dateModified": "2026-08-23T12:55:53-06:00",
    "datePublished": "2026-08-23T09:43:22-06:00",
    "description": "CVE-2026-16771 affects ARRIS BGW210-700 firmware 2.7.7 and earlier, enabling unauthenticated LAN users to read Wi-Fi keys and modify settings via web endpoints.",
    "headline": "CISA issues notice on authentication bypass in ARRIS BGW210-700 LAN management interface",
    "isBasedOn": {
      "@type": "CreativeWork",
      "author": {
        "@type": "Person",
        "name": "Molly Jaconski"
      },
      "sourceOrganization": {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/",
        "name": "Department of Homeland Security"
      },
      "url": "https://kb.cert.org/vuls/id/141367"
    },
    "keywords": [
      "Authentication",
      "Firmware",
      "gateway",
      "Local Area Network",
      "Vulnerabilities",
      "Wide Area Network",
      "Wi-Fi"
    ],
    "mainEntityOfPage": {
      "@id": "https://decisioninsights.ai/cisa-issues-notice-on-authentication-bypass-in-arris-bgw210-700-lan-management-interface/",
      "@type": "WebPage",
      "sdDatePublished": "2026-08-23",
      "sdPublisher": {
        "@id": "https://decisioninsights.ai/#organization"
      }
    },
    "mentions": [
      {
        "@id": "https://decisioninsights.ai/registry/commscope/arris/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/commscope/arris/",
        "name": "ARRIS"
      },
      {
        "@id": "https://decisioninsights.ai/registry/att/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/att/",
        "name": "AT&T"
      },
      {
        "@id": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/#organization",
        "@type": "Organization",
        "mainEntityOfPage": "https://decisioninsights.ai/registry/department-of-homeland-security/cybersecurity-and-infrastructure-security-agency-cisa/",
        "name": "Cybersecurity and Infrastructure Security Agency (CISA)"
      }
    ],
    "publisher": {
      "@id": "https://decisioninsights.ai/#organization"
    }
  },
  {
    "@context": "https://schema.org",
    "@id": "https://decisioninsights.ai/author/decision-insights-threat-desk/#person",
    "@type": "Person",
    "description": "CISA advisories, vendor security bulletins, and CVE disclosures, summarized into sourced briefs. Produced under our Standards & Methodology.",
    "name": "Decision Insights Threat Desk",
    "sameAs": [
      "https://www.linkedin.com/showcase/decisioninsights/"
    ],
    "url": "https://decisioninsights.ai/author/decision-insights-threat-desk/"
  }
]

Is this your company? Get structured data for your own pages