CVE-2016-10307 - CVE House
Back to Database
Status published Critical CVE-2016-10307

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and...

Vulnerability Description

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but the cleartext value is perhaps not yet public). This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2016-10307

Credits & Attribution

No credits recorded in the NVD database.

References

More from gotrango

View All →
CVE-2016-10305
Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0,...
Critical 9.8

Affected Vendor

Affected Software

apex lynx firmware, apex orion firmware, giga lynx firmware, giga orion firmware, stratalink firmware
Vulnerable Versions:
2.0, 0

Timeline

Official Publish: March 30th, 2017
Last Modified: August 6th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.