CVE-2026-24444: SDMC NE6037 Hardcoded Password via mgmt.php/npcmd.php

Synopsis

A hardcoded password vulnerability exists in the web management interface of SDMC NE6037 cable modem routers running firmware versions 7.1.6.0.25 and 7.1.6.1.9_B9. The flaw is reachable over the network with no authentication required: an attacker submits the hardcoded credential to the mgmt.php or npcmd.php recovery endpoints via plain HTTP. Successful exploitation gives the attacker root-level remote access to the device, including the ability to enable SSH and Telnet services for persistent control. No upstream fix has been published; HarborGuard tracks this advisory and will make a patched-image rebuild available the moment a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the device's HTTP management interface over the network; the vulnerable endpoints are exposed via the web management service on the device.

• AuthenticationNot required

  No account credentials are needed before exploitation; the hardcoded password itself serves as the bypass, requiring no prior authenticated session.

• Victim interactionNot required

  No user or administrator action is required; the attacker submits the HTTP request entirely on their own without any victim participation.

• Attack complexityDetail

  Exploit conditions are straightforward and reliable: no race conditions, memory layout dependencies, or special environmental factors are required to reproduce the attack.

Blast Radius

• Attacker obtains root-level command execution on the NE6037 device, gaining full control over the operating system and all running processes.
• Attacker can read all data stored or transiting the device, including network traffic, stored credentials, and configuration secrets.
• Attacker can modify device configuration, routing rules, and firewall policy, redirecting or intercepting subscriber traffic.
• Attacker can enable persistent SSH and Telnet services on the device, maintaining remote access independent of subsequent password changes to the normal management interface.