AT&T CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH AT&T CVE published 2026-07-28

CVE-2026-16771

The Arris BGW210-700 gateway has a critical vulnerability in firmware versions 2.7.7 and earlier. The /cgi-bin/*.ha management endpoints lack server-side authentication, relying on client-side CSS/JavaScript gating that can be bypassed by any HTTP client. This allows unauthenticated attackers on the LAN to read sensitive configuration data, modify persistent device settings, or trigger backend diagnostic operations.