CVE-2026-93338: Grandstream GWN7660ELR Information Disclosure

CVE-2026-93338 Overview

CVE-2026-93338 is an information disclosure vulnerability affecting Grandstream GWN7660ELR access points running firmware versions before 1.0.27.6. The device ships with a Simple Network Management Protocol version 2c (SNMP v2c) service configured using the default community string public. Unauthenticated remote attackers can query standard Management Information Bases (MIBs) over the SNMP port to enumerate operating system and kernel version, running processes and command-line arguments, network interfaces, routing and Address Resolution Protocol (ARP) tables, active TCP connections, and file system paths. The exposed data enables detailed reconnaissance of the device and adjacent network infrastructure. This weakness maps to [CWE-1188: Insecure Default Initialization of Resource].

Critical Impact
Unauthenticated attackers can enumerate host, process, and network topology data via SNMP without any credentials or user interaction.

Affected Products

Grandstream GWN7660ELR access point
Firmware versions prior to 1.0.27.6
Deployments exposing SNMP v2c with the default public community string

Discovery Timeline

2026-09-18 - CVE-2026-93338 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-93338

Vulnerability Analysis

The GWN7660ELR enables SNMP v2c by default with the community string public. SNMP v2c transmits community strings in cleartext and provides no cryptographic authentication. Any attacker with network reach to the SNMP service can read the MIB tree without credentials.

Querying standard MIBs such as HOST-RESOURCES-MIB, IF-MIB, IP-MIB, and TCP-MIB returns kernel version data, running process names with command-line arguments, interface configuration, routing entries, ARP mappings, active TCP sessions, and file system paths. This telemetry describes both the device and the internal networks it connects.

Attackers use the disclosed data to map trust boundaries, identify management services, and plan lateral movement. The exposure is passive from the target's perspective, producing minimal noise on the device.

Root Cause

The root cause is an insecure default configuration [CWE-1188]. The vendor ships firmware with SNMP v2c enabled and the well-known community string public in place. No forced credential change or setup wizard prompt exists prior to production use.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker sends SNMP GET and GETNEXT requests to UDP port 161 of a reachable GWN7660ELR device using the community string public. The device responds with MIB data covering operating system, process, and network context. See the VulnCheck Advisory on Grandstream SNMP for the full parameter set returned during exploitation.

Detection Methods for CVE-2026-93338

Indicators of Compromise

Inbound UDP traffic to port 161 on GWN7660ELR devices from unexpected internal or external sources.
SNMP GET/GETNEXT/GETBULK requests using the community string public against the device.
Sequential OID walks across 1.3.6.1.2.1 (MIB-2) subtrees indicating enumeration activity.

Detection Strategies

Deploy network intrusion detection signatures that alert on SNMP v2c queries with community string public traversing management segments.
Correlate SNMP scanning bursts with subsequent connections to management interfaces to surface reconnaissance chains.
Baseline expected SNMP pollers and alert on any source outside the approved allowlist that queries the device.

Monitoring Recommendations

Log and retain SNMP request metadata at the network edge and inside management VLANs for forensic review.
Monitor for unexpected outbound egress from GWN7660ELR devices, which may indicate follow-on post-reconnaissance activity.
Track firmware inventory to identify GWN7660ELR units still running versions earlier than 1.0.27.6.

How to Mitigate CVE-2026-93338

Immediate Actions Required

Upgrade GWN7660ELR firmware to version 1.0.27.6 or later using the Grandstream Firmware Support Page.
Change the SNMP community string from public to a unique, high-entropy value, or disable SNMP v2c if not required.
Restrict UDP port 161 access to authorized management hosts using ACLs and firewall rules.

Patch Information

Grandstream addresses the issue in firmware version 1.0.27.6 for the GWN7660ELR. Review the Grandstream GWN7660ELR Release Notes for full change details and installation guidance.

Workarounds

Disable SNMP v2c entirely on devices that do not require SNMP monitoring.
Migrate to SNMP v3 with authentication and encryption where SNMP telemetry is required.
Segment access points onto a dedicated management VLAN with strict ingress filtering on UDP 161.

bash

# Example ACL restricting SNMP to an authorized poller
access-list 110 permit udp host 10.10.0.25 host 10.20.5.1 eq 161
access-list 110 deny   udp any host 10.20.5.1 eq 161
access-list 110 permit ip any any