600k+ Arris cable modems have backdoors installed

While researching the subject, Rodrigues had found a previously undisclosed backdoor on Arris cable modems. But when extending the search through Shodan, Rodrigues claims that more than 600,000 externally accessible hosts are affected by the backdoor. The initial backdoor-admin password was disclosed as far back as 2009 and is based on a known seed.

The backdoor was found in the hidden administrative shell that can control the cable modems. The backdoor account can be used to remotely allow Telnet and SSH through the hidden HTTP administrative interface, or through custom SNMP MIBs.

---