CVE-2016-10309
CriticalSummary
In the GUI of Ceragon FibeAir IP-10 (before version 7.2.0), a remote attacker can bypass authentication by adding an ALBATROSS cookie with the value 0-4-11 to their browser.
Risk Assessment
An attacker can gain unauthorized access to the system, posing a serious threat to data security and device integrity.
Recommendation
It is recommended to update devices to version 7.2.0 or later to eliminate this vulnerability and to monitor system access.
Other vulnerabilities in Ceragon FibeAir IP-10
See all- CVE-2017-9137High
Ceragon FibeAir IP-10 wireless radios through version 7.2.0 have a default password 'mateidu' for a hidden user account. This account can be accessed via both the web interface and SSH, with SSH providing an attacker access to a Linux shell.
- CVE-2015-0936Critical
Ceragon FibeAir IP-10 has a default SSH public key in the authorized_keys file for the mateidu user, allowing remote attackers to gain SSH access by leveraging knowledge of the private key.
Original NVD description (English source)
In the GUI of Ceragon FibeAir IP-10 (before 7.2.0) devices, a remote attacker can bypass authentication by adding an ALBATROSS cookie with the value 0-4-11 to their browser.