Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.
References
Link | Resource |
---|---|
http://blog.iancaling.com/post/145309944453 | Exploit Third Party Advisory |
http://www.securityfocus.com/bid/97243 | Third Party Advisory VDB Entry |
History
No history.
MITRE Information
Status: PUBLISHED
Assigner: mitre
Published: 2017-03-30T07:00:00
Updated: 2017-03-31T09:57:02
Reserved: 2017-03-29T00:00:00
Link: CVE-2016-10308
JSON object: View
NVD Information
Status : Analyzed
Published: 2017-03-30T07:59:00.237
Modified: 2017-04-04T15:39:25.820
Link: CVE-2016-10308
JSON object: View
Redhat Information
No data.
CWE