CVE-2016-10308
CVE-2016-10308
9.8
CriticalPublished:
Last updated:
Source:cve@mitre.org
Modified
Weakness (CWE)
CVSS Vector
v3.0- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Description
Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.
References
cve@mitre.org
http://blog.iancaling.com/post/145309944453cve@mitre.org
http://www.securityfocus.com/bid/97243af854a3a-2127-422b-91ae-364da2661108
http://blog.iancaling.com/post/145309944453af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/97243