CVE-2017-20234

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2017-20234", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-03T18:00:44.958Z", "datePublished": "2026-04-03T22:49:58.377Z", "dateUpdated": "2026-10-01T19:19:01.356Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T19:19:01.356Z"}, "title": "GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String", "descriptions": [{"lang": "en", "value": "GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by exploiting a hardcoded string in the authentication mechanism. Attackers can bypass login controls to access administrative functions and sensitive switch configuration without valid credentials."}], "datePublic": "2017-05-08T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials", "type": "CWE"}]}], "affected": [{"vendor": "Belden", "product": "GarrettCom Magnum 6K and 10K Managed Switches", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.6.0"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.7.6"}, {"status": "unaffected", "version": "4.7.7", "versionType": "semver"}], "defaultStatus": "affected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:garrettcom:magnum_managed_networks_software-6k:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.6.0"}, {"vulnerable": true, "criteria": "cpe:2.3:a:garrettcom:magnum_managed_networks_software-6k:*:*:*:*:*:*:*:*", "versionEndIncluding": "4.7.6"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH", "version": "3.1", "baseSeverity": "CRITICAL", "baseScore": 9.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.3, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"}}], "references": [{"url": "https://assets.belden.com/m/114be964b4651983/original/Security-Bulletin-MNS-6K-10K-GarrettCom-BSECV-2017-08.pdf", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/garrettcom-magnum-6k-and-10k-authentication-bypass-via-hardcoded-string", "tags": ["third-party-advisory"]}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T18:05:08.248289Z", "id": "CVE-2017-20234", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T18:06:07.651Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2017-20234", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-06T18:05:08.248289Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T18:05:39.085Z"}}], "cna": {"title": "GarrettCom Magnum 6K and 10K Authentication Bypass via Hardcoded String", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Belden", "product": "GarrettCom Magnum 6K and 10K Managed Switches", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.6.0"}, {"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.7.6"}, {"status": "unaffected", "version": "4.7.7", "versionType": "semver"}], "defaultStatus": "affected"}], "datePublic": "2017-05-08T00:00:00.000Z", "references": [{"url": "https://assets.belden.com/m/114be964b4651983/original/Security-Bulletin-MNS-6K-10K-GarrettCom-BSECV-2017-08.pdf", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/garrettcom-magnum-6k-and-10k-authentication-bypass-via-hardcoded-string", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by exploiting a hardcoded string in the authentication mechanism. Attackers can bypass login controls to access administrative functions and sensitive switch configuration without valid credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798 Use of Hard-coded Credentials"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:garrettcom:magnum_managed_networks_software-6k:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "4.6.0"}, {"criteria": "cpe:2.3:a:garrettcom:magnum_managed_networks_software-6k:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndIncluding": "4.7.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-01T19:19:01.356Z"}}}, "cveMetadata": {"cveId": "CVE-2017-20234", "state": "PUBLISHED", "dateUpdated": "2026-10-01T19:19:01.356Z", "dateReserved": "2026-04-03T18:00:44.958Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-03T22:49:58.377Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "GarrettCom Magnum 6K and 10K Managed Switches", "vendor": "Belden", "versions": [{"lessThanOrEqual": "4.6.0", "status": "affected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "4.7.6", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "4.7.7", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "GarrettCom Magnum 6K and 10K managed switches contain an authentication bypass vulnerability that allows unauthenticated attackers to gain unauthorized access by exploiting a hardcoded string in the authentication mechanism. Attackers can bypass login controls to access administrative functions and sensitive switch configuration without valid credentials."}, {"lang": "es", "value": "Los switches gestionados GarrettCom Magnum 6K y 10K contienen una vulnerabilidad de omisi\u00f3n de autenticaci\u00f3n que permite a atacantes no autenticados obtener acceso no autorizado explotando una cadena codificada en el mecanismo de autenticaci\u00f3n. Los atacantes pueden omitir los controles de inicio de sesi\u00f3n para acceder a funciones administrativas y a la configuraci\u00f3n sensible del switch sin credenciales v\u00e1lidas."}], "id": "CVE-2017-20234", "lastModified": "2026-07-21T07:10:00.117", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 9.3, "baseSeverity": "CRITICAL", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2017-20234", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T18:05:08.248289Z", "version": "2.0.3"}}]}, "published": "2026-04-03T23:17:00.087", "references": [{"source": "disclosure@vulncheck.com", "url": "https://assets.belden.com/m/114be964b4651983/original/Security-Bulletin-MNS-6K-10K-GarrettCom-BSECV-2017-08.pdf"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/garrettcom-magnum-6k-and-10k-authentication-bypass-via-hardcoded-string"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.6.0]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.7.6]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "4.7.7"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "GarrettCom Magnum 6K and 10K Managed Switches", "source": "cna", "vendor": "Belden"}, "product": "garrettcom_magnum_6k_and_10k_managed_switches", "vendor": "belden"}], "analysis": {"en": {"generated_at": "2026-04-04T01:50:15.338632+00:00", "value": {"mitigation_remediation": ["Check the GarrettCom product page for firmware updates that address the authentication bypass issue", "If an update exists, flash the switch with the new firmware as soon as possible", "If no update is available, disable remote management interfaces or restrict access to trusted networks", "Apply network segmentation to limit management traffic to a secure subnet", "Enforce strong, unique passwords for all administrative accounts and implement password policies", "Monitor switch logs for suspicious activity and audit configuration changes frequently"], "summary": {"action": "Immediate Patch", "impact": "Unauthorized Administrative Access"}, "threat_synthesis": {"affected_systems": "Belden\u2019s GarrettCom Magnum 6K and 10K managed switches are affected. The vulnerability is present whenever the firmware includes the hardcoded authentication string, and no specific firmware ranges are listed, so any device still shipping with this flaw is potentially at risk.", "description_and_impact": "The flaw permits an attacker to bypass authentication by using a hardcoded string in the login mechanism, enabling unrestricted management of the switch. Consequently, an adversary could reconfigure network settings, expose confidential traffic, or create persistence channels, threatening the confidentiality, integrity, and availability of the network infrastructure.", "risk_and_exploitability": "A CVSS score of 9.3 indicates a severe risk level. No public exploit probability data is available, and the issue is not yet cataloged as a known exploited vulnerability, implying no widespread exploitation campaign is documented. The attacker would likely connect directly to the switch\u2019s management interface over the network to leverage the hardcoded credentials; no privileged credentials are required, making the vulnerability highly attractive for compromise."}}}}, "created": "2026-04-06T21:21:56.269322+00:00", "updated": "2026-04-06T22:21:34.185469+00:00", "vendors": ["belden", "belden$PRODUCT$garrettcom_magnum_6k_and_10k_managed_switches"]}