Details of VAR-201703-0102

ID

VAR-201703-0102

CVE

CVE-2016-10307

TITLE

plural Trango Vulnerabilities related to the use of hard-coded credentials in products

Trust: 0.8

sources: JVNDB: JVNDB-2016-008190

DESCRIPTION

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but the cleartext value is perhaps not yet public). This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it. plural Trango The product contains a vulnerability related to the use of hard-coded credentials.Information is obtained, information is altered, and service operation is disrupted (DoS) An attack may be carried out. Multiple Trango devices are prone to an insecure default-password vulnerability. Remote attackers with knowledge of the default credentials may exploit this vulnerability to gain unauthorized access and perform unauthorized actions. This may aid in further attacks. Prologix Trango Apex Lynx, etc. are all products of UAE Prologix company. Apex Lynx is an outdoor microwave backhaul system. Apex Orion is a full-duplex point-to-point radio link for use in Apex Lynx. A security vulnerability exists in several Prologix Trango products. The following products and versions are affected: Prologix Trango Apex Lynx Version 2.0, Apex Orion Version 2.0, Giga Lynx Version 2.0, Giga Orion Version 2.0, StrataLink Version 3.0

Trust: 1.98

sources: NVD: CVE-2016-10307 // JVNDB: JVNDB-2016-008190 // BID: 97242 // VULHUB: VHN-89070

AFFECTED PRODUCTS

vendor:	gotrango	model:	giga orion	scope:	eq	version:	2.0	Trust: 1.0
vendor:	gotrango	model:	stratalink	scope:	lte	version:	3.0	Trust: 1.0
vendor:	gotrango	model:	apex orion	scope:	eq	version:	2.0	Trust: 1.0
vendor:	gotrango	model:	apex lynx	scope:	eq	version:	2.0	Trust: 1.0
vendor:	gotrango	model:	giga lynx	scope:	eq	version:	2.0	Trust: 1.0
vendor:	trango	model:	apex lynx	scope:	-	version:	-	Trust: 0.8
vendor:	trango	model:	apex orion	scope:	-	version:	-	Trust: 0.8
vendor:	trango	model:	giga lynx	scope:	-	version:	-	Trust: 0.8
vendor:	trango	model:	giga orion	scope:	-	version:	-	Trust: 0.8
vendor:	trango	model:	stratalink	scope:	-	version:	-	Trust: 0.8
vendor:	trango	model:	apex orion	scope:	eq	version:	2.0	Trust: 0.6
vendor:	trango	model:	giga orion	scope:	eq	version:	2.0	Trust: 0.6
vendor:	trango	model:	giga lynx	scope:	eq	version:	2.0	Trust: 0.6
vendor:	trango	model:	stratalink	scope:	eq	version:	3.0	Trust: 0.6
vendor:	trango	model:	apex lynx	scope:	eq	version:	2.0	Trust: 0.6
vendor:	trango	model:	systems stratalink	scope:	eq	version:	3.0	Trust: 0.3
vendor:	trango	model:	systems gigaorion	scope:	eq	version:	2.0	Trust: 0.3
vendor:	trango	model:	systems gigalynx	scope:	eq	version:	2.0	Trust: 0.3
vendor:	trango	model:	systems apexorion	scope:	eq	version:	2.0	Trust: 0.3
vendor:	trango	model:	systems apexlynx	scope:	eq	version:	2.0	Trust: 0.3

sources: BID: 97242 // JVNDB: JVNDB-2016-008190 // CNNVD: CNNVD-201703-1392 // NVD: CVE-2016-10307

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2016-10307
value:	CRITICAL
Trust: 1.0
NVD:	CVE-2016-10307
value:	CRITICAL
Trust: 0.8
CNNVD:	CNNVD-201703-1392
value:	CRITICAL
Trust: 0.6
VULHUB:	VHN-89070
value:	HIGH
Trust: 0.1

nvd@nist.gov:	CVE-2016-10307
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-89070
severity:	HIGH
baseScore:	10.0
vectorString:	AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	10.0
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

nvd@nist.gov:	CVE-2016-10307
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	3.9
impactScore:	5.9
version:	3.1
Trust: 1.0
NVD:	CVE-2016-10307
baseSeverity:	CRITICAL
baseScore:	9.8
vectorString:	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector:	NETWORK
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	NONE
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	NONE
impactScore:	NONE
version:	3.0
Trust: 0.8

sources: VULHUB: VHN-89070 // JVNDB: JVNDB-2016-008190 // CNNVD: CNNVD-201703-1392 // NVD: CVE-2016-10307

PROBLEMTYPE DATA

problemtype:

CWE-798

Trust: 1.9

sources: VULHUB: VHN-89070 // JVNDB: JVNDB-2016-008190 // NVD: CVE-2016-10307

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201703-1392

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201703-1392

CONFIGURATIONS

sources: JVNDB: JVNDB-2016-008190

PATCH

title:

Top Page

url:

http://support.trangosys.com/hc/en-us

Trust: 0.8

sources: JVNDB: JVNDB-2016-008190

EXTERNAL IDS

db:	NVD	id:	CVE-2016-10307	Trust: 2.8
db:	BID	id:	97242	Trust: 2.0
db:	JVNDB	id:	JVNDB-2016-008190	Trust: 0.8
db:	CNNVD	id:	CNNVD-201703-1392	Trust: 0.7
db:	VULHUB	id:	VHN-89070	Trust: 0.1

sources: VULHUB: VHN-89070 // BID: 97242 // JVNDB: JVNDB-2016-008190 // CNNVD: CNNVD-201703-1392 // NVD: CVE-2016-10307

REFERENCES

url:	http://www.securityfocus.com/bid/97242	Trust: 1.7
url:	http://blog.iancaling.com/post/153011925478	Trust: 1.7
url:	http://blog.iancaling.com/post/153011925478/trango-systems-hidden-root-account-vulnerability	Trust: 1.1
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-10307	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2016-10307	Trust: 0.8
url:	https://www.trangosys.com/products/altum-series/	Trust: 0.3

sources: VULHUB: VHN-89070 // BID: 97242 // JVNDB: JVNDB-2016-008190 // CNNVD: CNNVD-201703-1392 // NVD: CVE-2016-10307

CREDITS

iancaling.

Trust: 0.3

sources: BID: 97242

SOURCES

db:	VULHUB	id:	VHN-89070
db:	BID	id:	97242
db:	JVNDB	id:	JVNDB-2016-008190
db:	CNNVD	id:	CNNVD-201703-1392
db:	NVD	id:	CVE-2016-10307

LAST UPDATE DATE

2025-04-20T23:42:16.117000+00:00

SOURCES UPDATE DATE

db:	VULHUB	id:	VHN-89070	date:	2017-04-04T00:00:00
db:	BID	id:	97242	date:	2017-04-04T00:02:00
db:	JVNDB	id:	JVNDB-2016-008190	date:	2017-04-28T00:00:00
db:	CNNVD	id:	CNNVD-201703-1392	date:	2021-05-06T00:00:00
db:	NVD	id:	CVE-2016-10307	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	VULHUB	id:	VHN-89070	date:	2017-03-30T00:00:00
db:	BID	id:	97242	date:	2017-03-29T00:00:00
db:	JVNDB	id:	JVNDB-2016-008190	date:	2017-04-28T00:00:00
db:	CNNVD	id:	CNNVD-201703-1392	date:	2017-03-31T00:00:00
db:	NVD	id:	CVE-2016-10307	date:	2017-03-30T07:59:00.220