CVEvulnerability

CVE-2016-10307

9.8 CRITICAL Published 2017-03-30 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-03-30
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-798

Description

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but the cleartext value is perhaps not yet public). This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.

Affected configurations

• gotrango apex lynx firmware 2.0 • gotrango apex orion firmware 2.0 • gotrango giga lynx firmware 2.0 • gotrango giga orion firmware 2.0 • gotrango stratalink firmware (<= 3.0)

Related

Weakness · CWE (1)

  • CWE-798 Use of Hard-coded Credentials weakness

References