CVE-2016-10308
CriticalSummary
Siklu EtherHaul radios before version 3.7.1 and 6.x before version 6.9.0 have a built-in, hidden root account with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface, allowing full control over the embedded Linux OS.
Risk Assessment
The presence of a hidden root account with an unchangeable password poses a serious security risk as it allows unauthorized access to devices and full control over them. This could lead to the compromise of the entire network infrastructure.
Recommendation
It is recommended to update the devices to the latest software version to eliminate this dangerous account. Additionally, monitoring access to devices and implementing further security measures is advised.
Original NVD description (English source)
Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.