CVEvulnerability

CVE-2016-10305

9.8 CRITICAL Published 2017-03-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-03-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-798

Description

Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.

Affected configurations

• gotrango apex plus firmware (<= 3.2.0) • gotrango apex firmware (<= 2.1.1) • gotrango apex lynx firmware (<= 1.2.3) • gotrango apex orion firmware (<= 1.2.3) • gotrango giga firmware (<= 2.6.1) • gotrango giga lynx firmware (<= 1.2.3) • gotrango giga orion firmware (<= 1.2.3) • gotrango giga plus firmware (<= 3.2.3) • gotrango giga pro firmware (<= 1.4.1) • gotrango stratalink pro firmware • gotrango stratalink firmware (<= 2.2.0)

Related

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References