CVE-2016-10308

Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.

Score

CVSS 3.0 9.8 Critical

Status

Modified - cve@mitre.org

Published

2017-03-30

Last modified

2024-08-06

Weaknesses

CWE-798

Affected products

• Etherhaul Firmware (Siklu)

References

• http://blog.iancaling.com/post/145309944453
• http://www.securityfocus.com/bid/97243