Predictable WPA2 PSKs in Arris DG860A and DG1670A Devices

CVE-2023-40038

What is CVE-2023-40038?

The Arris DG860A and DG1670A devices are susceptible to unauthorized remote access due to the use of predictable default WPA2 pre-shared keys (PSKs). The devices generate their WPA2 PSKs by utilizing the first six characters of the SSID combined with the last six characters of the BSSID, while decrementing the last digit. This predictability can be exploited by threat actors, potentially allowing them to gain unauthorized access to the network and compromise connected devices.

References