Is CVE-2017-9137 actively exploited?

No active exploitation of CVE-2017-9137 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2017-9137 be exploited remotely?

Yes. CVE-2017-9137 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2017-9137?

CVE-2017-9137 has a CVSS score of 7.3 (HIGH).

HOME VULNERABILITIESCVE-2017-9137

HIGH

CVE-2017-9137

CWE-1188Published: May 21, 2017· Updated: Jun 17, 2026

7.3

CVSS v3.1

Official Description

Ceragon FibeAir IP-10 wireless radios through 7.2.0 have a default password of mateidu for the mateidu account (a hidden user account established by the vendor). This account can be accessed via both the web interface and SSH. In the web interface, this simply grants an attacker read-only access to the device's settings. However, when using SSH, this gives an attacker access to a Linux shell. NOTE: the vendor has commented "The mateidu user is a known user, which is mentioned in the FibeAir IP-10 User Guide. Customers are instructed to change the mateidu user password. Changing the user password fully solves the vulnerability."

NVD Source

Technical Analysis

CVE-2017-9137 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.