CVE-2016-10307
CVE-2016-10307
9.8
CriticalPublished:
Last updated:
Source:cve@mitre.org
Modified
Weakness (CWE)
CVSS Vector
v3.1- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Description
Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but the cleartext value is perhaps not yet public). This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
References
cve@mitre.org
http://blog.iancaling.com/post/153011925478cve@mitre.org
http://www.securityfocus.com/bid/97242af854a3a-2127-422b-91ae-364da2661108
http://blog.iancaling.com/post/153011925478af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/97242