CVE-2016-10308

Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.
References
Link Resource
http://blog.iancaling.com/post/145309944453 Exploit Third Party Advisory
http://www.securityfocus.com/bid/97243 Third Party Advisory VDB Entry
http://blog.iancaling.com/post/145309944453 Exploit Third Party Advisory
http://www.securityfocus.com/bid/97243 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

AND
OR cpe:2.3:o:siklu:etherhaul_firmware:*:*:*:*:*:*:*:*
cpe:2.3:o:siklu:etherhaul_firmware:6.0:*:*:*:*:*:*:*
OR cpe:2.3:h:siklu:etherhaul-5500fd:-:*:*:*:*:*:*:*
cpe:2.3:h:siklu:etherhaul_500tx:-:*:*:*:*:*:*:*
cpe:2.3:h:siklu:etherhaul_60ghz_v-band_radio:-:*:*:*:*:*:*:*
cpe:2.3:h:siklu:etherhaul_70\/80ghz_gigabit_radio:-:*:*:*:*:*:*:*
cpe:2.3:h:siklu:etherhaul_70\/80ghz_multi-gigabit_e-band_radio:-:*:*:*:*:*:*:*
cpe:2.3:h:siklu:etherhaul_70ghz_e-band_radio:-:*:*:*:*:*:*:*

History

21 Nov 2024, 02:43

Type Values Removed Values Added
References () http://blog.iancaling.com/post/145309944453 - Exploit, Third Party Advisory () http://blog.iancaling.com/post/145309944453 - Exploit, Third Party Advisory
References () http://www.securityfocus.com/bid/97243 - Third Party Advisory, VDB Entry () http://www.securityfocus.com/bid/97243 - Third Party Advisory, VDB Entry

Information

Published : 2017-03-30 07:59

Updated : 2024-11-21 02:43


NVD link : CVE-2016-10308

Mitre link : CVE-2016-10308

CVE.ORG link : CVE-2016-10308


JSON object : View

Products Affected

siklu

  • etherhaul_70\/80ghz_gigabit_radio
  • etherhaul_70\/80ghz_multi-gigabit_e-band_radio
  • etherhaul_70ghz_e-band_radio
  • etherhaul_60ghz_v-band_radio
  • etherhaul_500tx
  • etherhaul_firmware
  • etherhaul-5500fd
CWE
CWE-798

Use of Hard-coded Credentials