CVE-2016-10305
CriticalSummary
Trango Apex, Giga, and Strata devices have a built-in, hidden root account with a default password that was stored in cleartext within a software update package. This account is accessible via SSH and/or TELNET, allowing full control over the device's operating system.
Risk Assessment
The presence of a hidden root account with a default password poses a serious security risk, allowing unauthorized users access to critical device functions. This could lead to device takeover and potential attacks on the network.
Recommendation
It is recommended to immediately change the default root password and restrict SSH and TELNET access to trusted IP addresses. Consider updating the software to the latest version to eliminate this vulnerability.
Original NVD description (English source)
Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.