Hardcoded credentials in the SDMC NE6037 router firmware allow unauthenticated attackers to gain full root-level remote control over the device.

The device contains hardcoded passwords within the mgmt.php and npcmd.php recovery endpoints. Unauthenticated attackers can submit these credentials via HTTP to trigger root access and enable unauthorized SSH or Telnet services.

The CVSS score of 9.8 highlights the critical nature of this vulnerability. Compromise of network infrastructure devices like cable modems allows attackers to intercept traffic, redirect users, or use the device as a persistent beachhead for further lateral movement within the network.

Immediate Action: Apply the latest firmware update provided by the vendor if available. If no update exists, isolate the management interface from the internet immediately to prevent external exploitation.

Proactive Monitoring: Monitor for unauthorized SSH or Telnet connections to the device. Check system logs for unexpected configuration changes or the activation of remote access services.

Compensating Controls: Restrict access to the router’s web management interface to trusted internal IP addresses only via firewall rules.

Public Exploit Available: Yes

This is a critical security failure requiring urgent attention. Network administrators must ensure these devices are not exposed to the public internet and should pursue vendor firmware updates as the primary method of permanent remediation.