CVE-2016-10308

{"id": "CVE-2016-10308", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2017-03-30T07:59:00.237", "references": [{"url": "http://blog.iancaling.com/post/145309944453", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/97243", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-798"}]}], "descriptions": [{"lang": "en", "value": "Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it."}, {"lang": "es", "value": "Siklu EtherHaul radios en versiones anteriores a 3.7.1 y 6.x en versiones anteriores a 6.9.0 tienen incorporada, una cuenta root oculta, con una contrase\u00f1a inalterable que es la misma en todos los dispositivos. Esta cuenta es accesible a trav\u00e9s de SSH y la interface web del dispositivo y concede el acceso al OS Linux incrustado en el dispositivo, permitiendo un control total sobre \u00e9l."}], "lastModified": "2017-04-04T15:39:25.820", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:siklu:etherhaul_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4E5FCA0E-EE0E-423C-9805-DC6F4E8416D1", "versionEndIncluding": "3.7.0"}, {"criteria": "cpe:2.3:o:siklu:etherhaul_firmware:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1C6BC2B9-5985-4DD5-93A1-5CD6603F4B21"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:siklu:etherhaul-5500fd:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "129AECB7-8446-43D4-8D68-6B889DEB9E8A"}, {"criteria": "cpe:2.3:h:siklu:etherhaul_500tx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "06C63B8C-013D-4C6B-9AE0-B93F9B48B7DB"}, {"criteria": "cpe:2.3:h:siklu:etherhaul_60ghz_v-band_radio:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "677C7A13-EE9C-4423-A2CB-7A631B03AA32"}, {"criteria": "cpe:2.3:h:siklu:etherhaul_70\\/80ghz_gigabit_radio:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B7B64120-E688-4F85-9425-D1F62AE9EB7A"}, {"criteria": "cpe:2.3:h:siklu:etherhaul_70\\/80ghz_multi-gigabit_e-band_radio:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6CDAA518-3237-47A6-9C2E-DF1506262939"}, {"criteria": "cpe:2.3:h:siklu:etherhaul_70ghz_e-band_radio:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A3970FA0-7CBD-484D-A580-CD4A74C63075"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}