PatchTheCVECVE-2017-8771: On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default cr
CVE-2017-8771 is a critical-severity flaw (CVSS 9.8) affecting wifi repeater firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root"). The attacker can make a user that is connected to the repeater click on a malicious link that will log into the telnet and will infect the device with malicious code.
Why this priority
- Critical severity
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 9.8 (Critical) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.4% (top 27%) |
| CISA exploited list | No |
| Weakness | CWE-798 |
| Published | 2017-09-20 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2017-8771?
wifi repeater firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2017-8771 being exploited?
CVE-2017-8771 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2017-8771 affect?
CVE-2017-8771 affects wifi repeater firmware. Severity is critical (CVSS 9.8). On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username:"root" password:"root"). The attacker can make a user that is connected to the repeater click on a mal
How urgent is CVE-2017-8771?
Priority 57/100. Critical severity; Remotely exploitable, no login, no user action
Software pages
Related CVEs
- CVE-2017-8772 CRITICAL 9.8 MITIGATE On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default cr
- CVE-2017-8770 HIGH 7.5 MITIGATE There is LFD (local file disclosure) on BE126 WIFI repeater 1.0 devices that allows attackers to read the enti
- CVE-2017-13713 HIGH 8.8 MITIGATE T&W WIFI Repeater BE126 allows remote authenticated users to execute arbitrary code via shell metacharacters i