CVE-2016-10307

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-03-30 · updated 2026-06-17
Weakness: CWE-798

Description

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but the cleartext value is perhaps not yet public). This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.

Affected products

Gotrango Apex Lynx Firmware: 2.0
Gotrango Apex Orion Firmware: 2.0
Gotrango Giga Lynx Firmware: 2.0
Gotrango Giga Orion Firmware: 2.0
Gotrango Stratalink Firmware: through 3.0

References

http://blog.iancaling.com/post/153011925478
http://www.securityfocus.com/bid/97242
http://blog.iancaling.com/post/153011925478
http://www.securityfocus.com/bid/97242

Get alerted when CVE-2016-10307 or the next vulnerability affects your stack