SDMC NE6037 cable modem routers running firmware 7.1.6.0.25 and 7.1.6.1.9_B9 contain a hardcoded password vulnerability in the web management interface recovery…

Published:

27 mei 2026 om 22:00:00

Alert date:

28 mei 2026 om 18:03:14

Source:

nvd.nist.gov

Mobile & IoT, Network Infrastructure

SDMC NE6037 cable modem routers running firmware versions 7.1.6.0.25 and 7.1.6.1.9_B9 contain a critical hardcoded password vulnerability in web management interface recovery endpoints (mgmt.php, npcmd.php). Unauthenticated attackers can exploit this vulnerability to gain root access by submitting hardcoded credentials via HTTP. Once exploited, attackers can enable SSH and Telnet services, providing persistent root-level remote access to the underlying system. This vulnerability affects the device's recovery functionality and bypasses authentication mechanisms entirely.

Technical details

Mitigation steps:

Affected products:

SDMC NE6037 cable modem router