The Arris BGW210‑700 gateway’s firmware versions 2.7.7 and earlier do not enforce server‑side authentication on any /cgi-bin/*.ha management endpoint. Instead, these routes rely solely on client‑side CSS and JavaScript checks that can be bypassed by a simple HTTP request from any device on the local network. This omission permits an unauthenticated attacker to read, alter or delete configuration data and to invoke diagnostic functions, leading to complete control over device settings.

The product is AT&T’s Arris BGW210‑700 router. Firmware 2.7.7 and all earlier releases are affected; newer firmware is expected to address the flaw.

The CVSS score of 8.8 classifies the flaw as high severity, while an EPSS score of less than 1% indicates that exploitation has not been widely observed. The vulnerability is not listed in the CISA KEV catalog. Attackers with local network access can reach the unprotected /cgi-bin/*.ha endpoints with ordinary HTTP requests, allowing them to read or modify router configuration without authentication, so the risk remains significant for any device on the LAN.