What’s Vulnerable › Vulnerabilities

CVE-2024-31970

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-07-24 · updated 2026-06-17
• Weakness: CWE-863

Description

AdTran SRG 834-5 HDC17600021F1 devices (with SmartOS 11.1.1.1 and fixed in Version 12.1.3.1) have SSH enabled by default, accessible both over the LAN and the Internet. During a window of time when the device is being set up, it uses a default username and password combination of admin/admin with root-level privileges. An attacker can exploit this window to gain unauthorized root access by either modifying the existing admin account or creating a new account with equivalent privileges. This vulnerability allows attackers to execute arbitrary commands. NOTE: The vendor has disputed this, finding the report not applicable. According to AdTran, SSH has never been accessible (from WAN) on SmartOS official builds. Furthermore, the vendor adds that test build 11.1.0.101-202106231430 was never released to end users.

Affected products

• Adtran Sdg Smartos: before 12.1.3.1 — fixed in 12.1.3.1

How to fix

Upgrade to a fixed version: Adtran Sdg Smartos 12.1.3.1. Check the vendor advisory for mitigations.

References

• https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31970
• https://github.com/actuator/cve/blob/main/AdTran/SRG-834-5
• https://supportcommunity.adtran.com/t5/Security-Advisories/ADTSA-2024001-Multiple-vulnerabilities-in-Service-Delivery-Gateway-products/ta-p/39332
• https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31970
• https://github.com/actuator/cve/blob/main/AdTran/SRG-834-5

Get alerted when CVE-2024-31970 or the next vulnerability affects your stack