CVE-2026-16771: CWE-306 Missing Authentication for Critical Function in AT&T Arris BGW210‑700
Overview Firmware versions 2.7.7 and earlier of the Arris BGW210-700 residential gateway contain an authentication bypass vulnerability, tracked as CVE-2026-16771, that allows any unauthenticated LAN-side user to read sensitive configuration data and modify device settings through web management endpoints. Although this vulnerability was recently discovered, the majority of in-service gateways are not expected to be running the affected version. Only devices that have not received automated ISP-managed firmware updates since version 2.7.7 in 2020 are vulnerable. Description The Arris BGW210-700 is a residential gateway used widely in AT&T deployments to provide routing, wireless networking, and wide-area network (WAN) connectivity for home users. The device exposes a browser-based management interface on the local-area network (LAN) side that allows users to configure WiFi settings, check diagnostics, and run system operations. Several CGI (Common Gateway Interface) handlers within the BGW210-700's web interface do not enforce any server-side authentication checks. Although the interface presents an "Access Code" prompt to users, this restriction is entirely implemented through client-side HTML and JavaScript and is not validated by the server before processing requests. As a result, any HTTP client that ignores client-side code can directly access and interact with the underlying CGI endpoints. The lack of server-side authentication affects multiple configuration and diagnostic pages. The wconfig_unified.ha endpoint returns the plaintext WiFi pre-shared key for all configured SSIDs to any unauthenticated requester. The broadbandconfig.ha endpoint accepts unauthenticated POST requests that directly modify WAN configuration parameters, including settings that persist across device reboots. Additional diagnostic endpoints, such as diag.ha , allow unauthenticated triggering of backend diagnostic jobs. Impact This vulnerability allows any unauthenticated user on the LAN, including devices connected to the gateway through the main WiFi network, Guest WiFi network, or LAN ethernet, to read sensitive configuration information and make persistent changes to gateway settings. A local attacker can retrieve the network's plaintext WiFi password with a single HTTP request and achieve unauthorized access to manipulate, intrude on, and interfere with protected networks. Solution This gateway is ISP-managed, so all standard internet-connected devices are expected to have been automatically updated to newer unaffected versions. Users can determine their active version by checking their router's diagnostic settings via web browser, and optionally contact their ISP to confirm that automatic updates are functioning correctly. Because the vulnerability is limited to the LAN-side management interface, standard network hygiene practices such as isolating untrusted devices, keeping IoT systems updated, and monitoring for the presence of unknown clients can further reduce risk in environments where older firmware may still be present. Acknowledgements Thanks to David Weekly for researching and reporting this vulnerability. This document was written by Molly Jaconski. Vendor Information One or more vendors are listed for this advisory. Please reference the full report for more information. Other Information CVE IDs: CVE-2026-16771 Date Public: 2026-07-28 Date First Published: 2026-07-28 Date Last Updated: 2026-07-28 18:43 UTC Document Revision: 3 About vulnerability notes Contact us about this vulnerability Provide a vendor statement
AI Analysis
Technical Summary
CVE-2026-16771 describes a missing authentication vulnerability (CWE-306) in the Arris BGW210-700 gateway firmware versions 2.7.7 and earlier. The device fails to enforce server-side authentication on its management endpoints under /cgi-bin/*.ha, relying solely on client-side CSS/JavaScript gating. This flaw allows unauthenticated attackers with LAN access to bypass controls and perform sensitive actions including reading configuration data, modifying persistent settings, and triggering backend diagnostics. The vulnerability is systemic across the CGI handler chain, indicating a broad failure in authentication enforcement for these critical functions.
Potential Impact
An unauthenticated attacker on the local network can exploit this vulnerability to gain unauthorized access to sensitive configuration information, alter device settings persistently, and invoke backend diagnostic operations. This can lead to full compromise of device integrity, confidentiality, and availability. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability with low attack complexity and no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/141367 for current remediation guidance. Until an official fix is available, restrict LAN access to trusted users only and monitor for unauthorized access attempts to the /cgi-bin/*.ha endpoints. Do not rely on client-side controls for security.
CVE-2026-16771: CWE-306 Missing Authentication for Critical Function in AT&T Arris BGW210‑700
Description
Overview Firmware versions 2.7.7 and earlier of the Arris BGW210-700 residential gateway contain an authentication bypass vulnerability, tracked as CVE-2026-16771, that allows any unauthenticated LAN-side user to read sensitive configuration data and modify device settings through web management endpoints. Although this vulnerability was recently discovered, the majority of in-service gateways are not expected to be running the affected version. Only devices that have not received automated ISP-managed firmware updates since version 2.7.7 in 2020 are vulnerable. Description The Arris BGW210-700 is a residential gateway used widely in AT&T deployments to provide routing, wireless networking, and wide-area network (WAN) connectivity for home users. The device exposes a browser-based management interface on the local-area network (LAN) side that allows users to configure WiFi settings, check diagnostics, and run system operations. Several CGI (Common Gateway Interface) handlers within the BGW210-700's web interface do not enforce any server-side authentication checks. Although the interface presents an "Access Code" prompt to users, this restriction is entirely implemented through client-side HTML and JavaScript and is not validated by the server before processing requests. As a result, any HTTP client that ignores client-side code can directly access and interact with the underlying CGI endpoints. The lack of server-side authentication affects multiple configuration and diagnostic pages. The wconfig_unified.ha endpoint returns the plaintext WiFi pre-shared key for all configured SSIDs to any unauthenticated requester. The broadbandconfig.ha endpoint accepts unauthenticated POST requests that directly modify WAN configuration parameters, including settings that persist across device reboots. Additional diagnostic endpoints, such as diag.ha , allow unauthenticated triggering of backend diagnostic jobs. Impact This vulnerability allows any unauthenticated user on the LAN, including devices connected to the gateway through the main WiFi network, Guest WiFi network, or LAN ethernet, to read sensitive configuration information and make persistent changes to gateway settings. A local attacker can retrieve the network's plaintext WiFi password with a single HTTP request and achieve unauthorized access to manipulate, intrude on, and interfere with protected networks. Solution This gateway is ISP-managed, so all standard internet-connected devices are expected to have been automatically updated to newer unaffected versions. Users can determine their active version by checking their router's diagnostic settings via web browser, and optionally contact their ISP to confirm that automatic updates are functioning correctly. Because the vulnerability is limited to the LAN-side management interface, standard network hygiene practices such as isolating untrusted devices, keeping IoT systems updated, and monitoring for the presence of unknown clients can further reduce risk in environments where older firmware may still be present. Acknowledgements Thanks to David Weekly for researching and reporting this vulnerability. This document was written by Molly Jaconski. Vendor Information One or more vendors are listed for this advisory. Please reference the full report for more information. Other Information CVE IDs: CVE-2026-16771 Date Public: 2026-07-28 Date First Published: 2026-07-28 Date Last Updated: 2026-07-28 18:43 UTC Document Revision: 3 About vulnerability notes Contact us about this vulnerability Provide a vendor statement
CVSS v3.1
Score 8.8high
Affected software
AT&T
Arris BGW210‑700
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16771 describes a missing authentication vulnerability (CWE-306) in the Arris BGW210-700 gateway firmware versions 2.7.7 and earlier. The device fails to enforce server-side authentication on its management endpoints under /cgi-bin/*.ha, relying solely on client-side CSS/JavaScript gating. This flaw allows unauthenticated attackers with LAN access to bypass controls and perform sensitive actions including reading configuration data, modifying persistent settings, and triggering backend diagnostics. The vulnerability is systemic across the CGI handler chain, indicating a broad failure in authentication enforcement for these critical functions.
Potential Impact
An unauthenticated attacker on the local network can exploit this vulnerability to gain unauthorized access to sensitive configuration information, alter device settings persistently, and invoke backend diagnostic operations. This can lead to full compromise of device integrity, confidentiality, and availability. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability with low attack complexity and no required privileges or user interaction.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory at https://kb.cert.org/vuls/id/141367 for current remediation guidance. Until an official fix is available, restrict LAN access to trusted users only and monitor for unauthorized access attempts to the /cgi-bin/*.ha endpoints. Do not rely on client-side controls for security.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- certcc
- Date Reserved
- 2026-07-23T16:36:49.550Z
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://kb.cert.org/vuls/id/141367","vendor":"CERT"}]
Threat ID: 6a68fdfc9c2644c7f8116816
Added to database: 07/28/2026, 19:07:40 UTC
Last enriched: 07/29/2026, 14:52:14 UTC
Last updated: 09/12/2026, 22:01:31 UTC
Views: 88
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.