What’s Vulnerable › Vulnerabilities

CVE-2016-10308

• Severity: critical (CVSS 9.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 3.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2017-03-30 · updated 2026-06-17
• Weakness: CWE-798

Description

Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.

Affected products

• Siklu Etherhaul Firmware: through 3.7.0; 6.0

References

• http://blog.iancaling.com/post/145309944453
• http://www.securityfocus.com/bid/97243
• http://blog.iancaling.com/post/145309944453
• http://www.securityfocus.com/bid/97243

Get alerted when CVE-2016-10308 or the next vulnerability affects your stack