The Verizon Wireless Network Extender SCS-26UC4 and SCS-2U01 does not use CAVE…
Priority LOW 15CWE-287Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- High
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · Partial · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
The Verizon Wireless Network Extender SCS-26UC4 and SCS-2U01 does not use CAVE authentication, which makes it easier for remote attackers to obtain ESN and MIN values from arbitrary phones, and conduct cloning attacks, by sniffing the network for registration packets.
Why it matters now
EPSS 0.00784 56th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2013-4877
- 2026-10-03 Alias added: GHSA-p7rg-rp2h-c9h8
References
Advisory 1
More Verizon Wireless Network Extender vulnerabilities
- TI-2013-04280 The Verizon Wireless Network Extender SCS-2U01 has a hardcoded password for the root… CVSS 2.0MEDIUM 6.2
- TI-2013-04279 The Uboot bootloader on the Verizon Wireless Network Extender SCS-2U01 allows physically… CVSS 2.0MEDIUM 6.2
- TI-2013-04278 The Uboot bootloader on the Verizon Wireless Network Extender SCS-26UC4 allows physically… CVSS 2.0MEDIUM 6.2
Sources
- CVE-2013-4877 · CVE Program
- CVE-2013-4877 · NVD
- FIRST EPSS
- GHSA-p7rg-rp2h-c9h8 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences