Cyber Posture

CVE-2026-2617

MediumPublic PoC

Published: 17 February 2026

Published
17 February 2026
Modified
19 February 2026
KEV Added
Patch
CVSS Score 6.3 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0006 19.0th percentile
Risk Priority 13 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2617 is a medium-severity Initialization of a Resource with an Insecure Default (CWE-1188) vulnerability in Beetel 777Vr1 Firmware. Its CVSS base score is 6.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Default Accounts (T1078.001); ranked at the 19.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Default Accounts (T1078.001) and 2 other techniques.
Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-1188

Requires documented secure initialization practices and avoidance of insecure defaults in configuration baselines.

addresses: CWE-1188

Reviewing and updating baseline when components are installed or upgraded prevents initialization with insecure defaults.

addresses: CWE-1188

Requiring explicit configuration to minimal functionality overrides insecure defaults that would otherwise enable excess capabilities.

addresses: CWE-1188

Tailoring replaces or augments insecure default initializations with system-specific values and compensating controls before deployment.

addresses: CWE-1188

Central configuration overrides or replaces insecure default initializations that would otherwise be left unchanged on each system.

addresses: CWE-1188

SCRM practices during acquisition and configuration management address insecure default initializations shipped by vendors.

addresses: CWE-1188

Scans detect resources initialized with insecure defaults that create exploitable conditions.

addresses: CWE-1188

Instruction on secure initialization of security controls prevents leaving resources with insecure defaults after installation.

MITRE ATT&CK Enterprise TechniquesAI

T1078.001 Default Accounts Stealth
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1021.004 SSH Lateral Movement
Adversaries may use [Valid Accounts](https://attack.
T1133 External Remote Services Persistence
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Why these techniques?

Insecure default initialization (CWE-1188) in Telnet/SSH services on adjacent network allows unauthenticated access, directly enabling default account usage and external/remote service exploitation with public PoC available.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was found in Beetel 777VR1 up to 01.00.09. This affects an unknown function of the component Telnet Service/SSH Service. The manipulation results in insecure default initialization of resource. The attack can only be performed from the local network.…

more

The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2026-2617 is a vulnerability discovered in Beetel 777VR1 devices up to version 01.00.09, affecting an unknown function within the Telnet Service/SSH Service component. The issue stems from insecure default initialization of a resource, classified under CWE-1188, and carries a CVSS v3.1 base score of 6.3 (AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). It was published on 2026-02-17.

Exploitation requires an attacker to be on the local network, with no privileges or user interaction needed. Successful manipulation can result in low impacts to confidentiality, integrity, and availability. A public exploit is available and could be used, as detailed in referenced proof-of-concept steps.

Advisories from VulDB and a GitHub gist indicate the vendor was contacted early about the disclosure but provided no response, with no patches or official mitigations mentioned. Security practitioners should isolate affected devices from local networks where possible and monitor for exploit attempts using the public references.

Details

CWE(s)

Affected Products

beetel
777vr1 firmware
≤ 01.00.09_55

CVEs Like This One

CVE-2026-2616Same product: Beetel 777Vr1
CVE-2026-2618Same product: Beetel 777Vr1
CVE-2025-62877Shared CWE-1188
CVE-2025-1960Shared CWE-1188
CVE-2026-33037Shared CWE-1188
CVE-2025-70998Shared CWE-1188
CVE-2025-69970Shared CWE-1188
CVE-2026-44109Shared CWE-1188
CVE-2026-43581Shared CWE-1188
CVE-2018-25169Shared CWE-1188

References