10

CVE-2016-10305

Exploit
Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Gotrango ≫ Apex Plus Firmware Version <= 3.2.0
   Gotrango ≫ Apex Plus Version -
Gotrango ≫ Apex Firmware Version <= 2.1.1
   Gotrango ≫ Apex Version -
Gotrango ≫ Apex Lynx Firmware Version <= 1.2.3
   Gotrango ≫ Apex Lynx Version -
Gotrango ≫ Apex Orion Firmware Version <= 1.2.3
   Gotrango ≫ Apex Orion Version -
Gotrango ≫ Giga Firmware Version <= 2.6.1
   Gotrango ≫ Giga Version -
Gotrango ≫ Giga Lynx Firmware Version <= 1.2.3
   Gotrango ≫ Giga Lynx Version -
Gotrango ≫ Giga Orion Firmware Version <= 1.2.3
   Gotrango ≫ Giga Orion Version -
Gotrango ≫ Giga Plus Firmware Version <= 3.2.3
   Gotrango ≫ Giga Plus Version -
Gotrango ≫ Giga Pro Firmware Version <= 1.4.1
   Gotrango ≫ Giga Pro Version -
Gotrango ≫ Stratalink Pro Firmware Version -
   Gotrango ≫ Stratalink Pro Version -
Gotrango ≫ Stratalink Firmware Version <= 2.2.0
   Gotrango ≫ Stratalink Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.7% 0.754
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

http://blog.iancaling.com/post/153011925478
Third Party Advisory
Exploit