CVE-2016-10305 - CVE House
Back to Database
Status published Critical CVE-2016-10305

Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0,...

Vulnerability Description

Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-10305

Credits & Attribution

No credits recorded in the NVD database.

References

More from gotrango

View All →
CVE-2016-10307
Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and...
Critical 9.8

Affected Vendor

Affected Software

apex plus firmware, apex firmware, apex lynx firmware, apex orion firmware, giga firmware, giga lynx firmware, giga orion firmware, giga plus firmware, giga pro firmware, stratalink pro firmware, stratalink firmware
Vulnerable Versions:
0

Timeline

Official Publish: March 30th, 2017
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.