Arris BGW210-700 gateway auth bypass flaw
An authentication bypass in old Arris BGW210-700 firmware lets any LAN user read WiFi passwords and modify gateway settings without credentials.
CERT/CC disclosed CVE-2026-16771, an authentication bypass affecting Arris BGW210-700 residential gateways running firmware 2.7.7 or earlier, a device widely deployed by AT&T for home internet service. Several CGI-based web management endpoints, including wconfig_unified.ha, broadbandconfig.ha, and diag.ha, fail to perform any server-side authentication check. The device's "Access Code" prompt is enforced only through client-side HTML/JavaScript, meaning any HTTP client that bypasses the browser UI can interact directly with these backend endpoints.
The practical impact is significant at the individual device level: any unauthenticated LAN-side user, including guests on WiFi or wired clients, can retrieve the plaintext WiFi pre-shared key with a single HTTP request, and can send POST requests to persistently alter WAN configuration or trigger diagnostic jobs. This gives a local attacker full visibility into and control over the home network's wireless credentials and gateway configuration without needing to authenticate.
Exploitation is limited in scope because it requires LAN access, and the affected firmware version dates to 2020; since the device is ISP-managed, most in-service units have since received automatic updates and are not expected to be vulnerable. Only gateways that have not received an update since 2.7.7 remain exposed. CERT/CC recommends users verify their firmware version and confirm automatic updates are functioning, alongside standard LAN hygiene such as isolating untrusted devices and monitoring for unknown clients.
Mentioned in this report
Detection guidance
Direct Unauthenticated Access to Arris Gateway WiFi Config Endpoint
Detects HTTP GET requests to the wconfig_unified.ha CGI endpoint on vulnerable Arris BGW210-700 gateways, which discloses the plaintext WiFi PSK without any server-side authentication check. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Direct Unauthenticated Access to Arris Gateway WiFi Config Endpoint
description: Detects direct HTTP GET requests to the wconfig_unified.ha management
endpoint on Arris BGW210-700 gateways (CVE-2026-16771). This endpoint returns the
plaintext WiFi pre-shared key and has no server-side authentication check, so any
client bypassing the browser UI can retrieve credentials with a single request.
Generalises on the vulnerable endpoint path and method, not on any specific client
IP or campaign artefact.
tags:
- attack.credential_access
- attack.t1552
logsource:
category: proxy
detection:
selection:
c-uri|contains: /wconfig_unified.ha
cs-method: GET
filter_referer_from_admin_ui:
cs-referer|contains: /admin.html
condition: selection and not filter_referer_from_admin_ui
falsepositives:
- Legitimate administrator viewing WiFi settings through the gateway's own admin web
UI, which normally sets a Referer header from the login/admin page
- Automated network scanners or asset inventory tools probing the gateway's web management
surface
level: high
id: 9ce174b2-a17d-5651-8840-526338d1eb65
status: experimental
author: Vorant
Unauthenticated POST to Arris Gateway WAN Configuration Endpoint
Detects HTTP POST requests directly to broadbandconfig.ha, used to persistently alter WAN configuration on vulnerable Arris BGW210-700 gateways without any authentication check. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated POST to Arris Gateway WAN Configuration Endpoint
description: Detects HTTP POST requests to the broadbandconfig.ha CGI endpoint on
Arris BGW210-700 gateways (CVE-2026-16771). This endpoint allows persistent modification
of WAN configuration without any server-side session or credential validation, letting
any LAN client (e.g. a guest WiFi user) tamper with gateway configuration as if
they were a valid authenticated administrator. Generalises on the vulnerable endpoint
and HTTP method rather than any request body content.
tags:
- attack.persistence
- attack.t1078
logsource:
category: proxy
detection:
selection:
c-uri|contains: /broadbandconfig.ha
cs-method: POST
filter_referer_from_admin_ui:
cs-referer|contains: /admin.html
condition: selection and not filter_referer_from_admin_ui
falsepositives:
- ISP-managed remote provisioning or firmware management systems that legitimately
push WAN configuration changes through the same endpoint
- Administrator changing WAN settings through the gateway's own web UI after a normal
login
level: high
id: 139c4dee-00aa-58c7-bca2-22e1b4f47f20
status: experimental
author: Vorant
Unauthenticated Request to Arris Gateway Diagnostic Endpoint
Detects direct HTTP requests to diag.ha to trigger diagnostic jobs on vulnerable Arris BGW210-700 gateways without authentication, which can be used for reconnaissance or as part of a broader unauthenticated abuse chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unauthenticated Request to Arris Gateway Diagnostic Endpoint
description: Detects direct HTTP requests to the diag.ha CGI endpoint on Arris BGW210-700
gateways (CVE-2026-16771), which triggers diagnostic jobs without any server-side
authentication check. Frequently seen alongside requests to wconfig_unified.ha and
broadbandconfig.ha as part of unauthenticated LAN-side enumeration and abuse of
the gateway's management interface. Generalises on the endpoint path rather than
campaign-specific request parameters.
tags:
- attack.credential_access
- attack.t1552
logsource:
category: proxy
detection:
selection:
c-uri|contains: /diag.ha
filter_referer_from_admin_ui:
cs-referer|contains: /admin.html
condition: selection and not filter_referer_from_admin_ui
falsepositives:
- ISP remote diagnostic and support tooling legitimately invoking diagnostics through
this endpoint
- Administrator running connection diagnostics from the gateway's own admin web UI
after login
level: medium
id: 7cb02cf5-4795-5a1b-84e5-13c9b8c2896e
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/141367
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free