10

CVE-2016-10308

Exploit
Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Siklu ≫ Etherhaul Firmware Version <= 3.7.0
   Siklu ≫ Etherhaul-5500fd Version-
   Siklu ≫ Etherhaul 500tx Version-
   Siklu ≫ Etherhaul 60ghz V-band Radio Version-
   Siklu ≫ Etherhaul 70ghz E-band Radio Version-
Siklu ≫ Etherhaul Firmware Version6.0
   Siklu ≫ Etherhaul-5500fd Version-
   Siklu ≫ Etherhaul 500tx Version-
   Siklu ≫ Etherhaul 60ghz V-band Radio Version-
   Siklu ≫ Etherhaul 70ghz E-band Radio Version-
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.1% 0.825
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov 10 10 10
AV:N/AC:L/Au:N/C:C/I:C/A:C
CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

http://blog.iancaling.com/post/145309944453
Third Party Advisory
Exploit
http://www.securityfocus.com/bid/97243
Third Party Advisory
VDB Entry