CVE-2015-2904
CVE-2015-2904 is a high-severity vulnerability in Actiontec Ncs01 Firmware with a CVSS 2.0 base score of 8.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 2.0 base score 8.3)
- EPSS exploit prediction: 1% (55th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Actiontec Ncs01 Firmware
- Published:
- Last modified:
Description
Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface.
Frequently asked questions
- What is CVE-2015-2904?
- Actiontec GT784WN modems with firmware before NCS01-1.0.13 have hardcoded credentials, which makes it easier for remote attackers to obtain root access by connecting to the web administration interface.
- How severe is CVE-2015-2904?
- CVE-2015-2904 has a CVSS 2.0 base score of 8.3, rated high severity.
- Is CVE-2015-2904 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2015-2904?
- CVE-2015-2904 affects Actiontec Ncs01 Firmware. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2015-2904?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2015-2904 published?
- CVE-2015-2904 was published on 2015-08-23 and last updated on 2026-06-17.
References
Affected products (1)
- cpe:2.3:o:actiontec:_ncs01_firmware:*:*:*:*:*:*:*:*
More vulnerabilities in Actiontec Ncs01 Firmware
- CVE-2015-2905 — Medium (CVSS 6.8): Cross-site request forgery (CSRF) vulnerability on Actiontec GT784WN modems with firmware before NCS01-1.0.13 allows…