What’s Vulnerable › Vulnerabilities

CVE-2016-10305

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-03-30 · updated 2026-06-17
• Weakness: CWE-798

Description

Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.

Affected products

• Gotrango Apex Firmware: through 2.1.1
• Gotrango Apex Lynx Firmware: through 1.2.3
• Gotrango Apex Orion Firmware: through 1.2.3
• Gotrango Apex Plus Firmware: through 3.2.0
• Gotrango Giga Firmware: through 2.6.1
• Gotrango Giga Lynx Firmware: through 1.2.3
• Gotrango Giga Orion Firmware: through 1.2.3
• Gotrango Giga Plus Firmware: through 3.2.3
• Gotrango Giga Pro Firmware: through 1.4.1
• Gotrango Stratalink Firmware: through 2.2.0
• Gotrango Stratalink Pro Firmware: all versions

References

• http://blog.iancaling.com/post/153011925478
• http://blog.iancaling.com/post/153011925478

Get alerted when CVE-2016-10305 or the next vulnerability affects your stack