A deterministic credential generation routine located in /ftl/bin/calc_f2 of the FreedomFi Englewood Sercomm SCE4255W small cell firmware allows an attacker to compute valid administrative or root credentials from the device's MAC address. This flaw enables an unauthenticated remote attacker to bypass the authentication mechanism and obtain unrestricted control over the device, representing a critical security weakness identified by CWE-1391. The high CVSS score of 9.8 indicates that the vulnerability can be exploited with minimal effort and yields complete device compromise.

The vulnerability affects the Sercomm SCE4255W small cell (FreedomFi Englewood) running firmware versions prior to DG3934v3@2308041842. Users should verify their firmware version and ensure it is updated to the latest release that eliminates the deterministic credential generation logic.

With a CVSS score of 9.8 the risk to any affected device is severe. Although the EPSS score is below 1% and the flaw is not listed in CISA's KEV catalog, the exploitation pathway—remote authentication bypass via credential derivation from a public MAC address—is straightforward. An attacker only needs to identify a target device’s MAC address, calculate the administrative credentials using the disclosed algorithm, and then authenticate to gain full device access. The flaw remains exploitable until the firmware is updated or remote management is otherwise disabled.