Sign-up

ID

VAR-201807-0050


CVE

CVE-2016-6552


TITLE

Green Packet DX-350 contains insecure default credentials

Trust: 0.8

sources: CERT/CC: VU#970379

DESCRIPTION

Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device. This may aid in further attacks

Trust: 2.79

sources: NVD: CVE-2016-6552 // CERT/CC: VU#970379 // JVNDB: JVNDB-2016-005558 // BID: 93806 // VULHUB: VHN-95372 // VULMON: CVE-2016-6552

AFFECTED PRODUCTS

vendor:greenpacketmodel:dx-350scope:eqversion: -

Trust: 1.6

vendor:green packetmodel:dx-350scope: - version: -

Trust: 0.8

vendor:greenmodel:packet dx-350scope:eqversion:0

Trust: 0.3

sources: BID: 93806 // JVNDB: JVNDB-2016-005558 // CNNVD: CNNVD-201610-696 // NVD: CVE-2016-6552

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2016-6552
value: CRITICAL

Trust: 1.0

NVD: CVE-2016-6552
value: MEDIUM

Trust: 0.8

IPA: JVNDB-2016-005558
value: HIGH

Trust: 0.8

CNNVD: CNNVD-201610-696
value: CRITICAL

Trust: 0.6

VULHUB: VHN-95372
value: HIGH

Trust: 0.1

VULMON: CVE-2016-6552
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2016-6552
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.1

NVD: CVE-2016-6552
severity: MEDIUM
baseScore: 6.9
vectorString: NONE
accessVector: LOCAL
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 3.4
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

IPA: JVNDB-2016-005558
severity: HIGH
baseScore: 9.3
vectorString: AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

VULHUB: VHN-95372
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2016-6552
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.0

IPA: JVNDB-2016-005558
baseSeverity: HIGH
baseScore: 8.1
vectorString: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: HIGH
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CERT/CC: VU#970379 // VULHUB: VHN-95372 // VULMON: CVE-2016-6552 // JVNDB: JVNDB-2016-005558 // CNNVD: CNNVD-201610-696 // NVD: CVE-2016-6552

PROBLEMTYPE DATA

problemtype:CWE-255

Trust: 1.9

sources: VULHUB: VHN-95372 // JVNDB: JVNDB-2016-005558 // NVD: CVE-2016-6552

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201610-696

TYPE

trust management problem

Trust: 0.6

sources: CNNVD: CNNVD-201610-696

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2016-005558

EXPLOIT AVAILABILITY
sources:
            
            
            CERT/CC: VU#970379

EXTERNAL IDS
db:CERT/CCid:VU#970379
Trust: 3.7
db:NVDid:CVE-2016-6552
Trust: 2.9
db:BIDid:93806
Trust: 2.1
db:JVNid:JVNVU99656851
Trust: 0.8
db:JVNDBid:JVNDB-2016-005558
Trust: 0.8
db:CNNVDid:CNNVD-201610-696
Trust: 0.7
db:VULHUBid:VHN-95372
Trust: 0.1
db:VULMONid:CVE-2016-6552
Trust: 0.1
sources:
            
            
            CERT/CC: VU#970379 // 
            
            
            
            VULHUB: VHN-95372 // 
            
            
            
            VULMON: CVE-2016-6552 // 
            
            
            
            BID: 93806 // 
            
            
            
            JVNDB: JVNDB-2016-005558 // 
            
            
            
            CNNVD: CNNVD-201610-696 // 
            
            
            
            NVD: CVE-2016-6552

REFERENCES
url:https://www.kb.cert.org/vuls/id/970379
Trust: 3.0
url:https://www.securityfocus.com/bid/93806
Trust: 1.9
url:https://www.akamai.com/us/en/multimedia/documents/state-of-the-internet/sshowdown-exploitation-of-iot-devices-for-launching-mass-scale-attack-campaigns.pdf
Trust: 1.6
url:http://cwe.mitre.org/data/definitions/255.html
Trust: 0.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-6552
Trust: 0.8
url:http://jvn.jp/vu/jvnvu99656851/index.html
Trust: 0.8
url:https://nvd.nist.gov/vuln/detail/cve-2016-6552
Trust: 0.8
url:http://www.greenpacket.com/
Trust: 0.3
url:https://nvd.nist.gov
Trust: 0.1
sources:
            
            
            CERT/CC: VU#970379 // 
            
            
            
            VULHUB: VHN-95372 // 
            
            
            
            VULMON: CVE-2016-6552 // 
            
            
            
            BID: 93806 // 
            
            
            
            JVNDB: JVNDB-2016-005558 // 
            
            
            
            CNNVD: CNNVD-201610-696 // 
            
            
            
            NVD: CVE-2016-6552

CREDITS
Ory Segal and Ezra Caltum
Trust: 0.9
sources:
            
            
            BID: 93806 // 
            
            
            
            CNNVD: CNNVD-201610-696

SOURCES
db:CERT/CCid:VU#970379
db:VULHUBid:VHN-95372
db:VULMONid:CVE-2016-6552
db:BIDid:93806
db:JVNDBid:JVNDB-2016-005558
db:CNNVDid:CNNVD-201610-696
db:NVDid:CVE-2016-6552

LAST UPDATE DATE
2024-11-23T22:41:48.726000+00:00

SOURCES UPDATE DATE
db:CERT/CCid:VU#970379date:2016-10-20T00:00:00
db:VULHUBid:VHN-95372date:2019-10-09T00:00:00
db:VULMONid:CVE-2016-6552date:2019-10-09T00:00:00
db:BIDid:93806date:2016-10-26T00:17:00
db:JVNDBid:JVNDB-2016-005558date:2016-10-24T00:00:00
db:CNNVDid:CNNVD-201610-696date:2019-10-17T00:00:00
db:NVDid:CVE-2016-6552date:2024-11-21T02:56:20.450

SOURCES RELEASE DATE
db:CERT/CCid:VU#970379date:2016-10-20T00:00:00
db:VULHUBid:VHN-95372date:2018-07-13T00:00:00
db:VULMONid:CVE-2016-6552date:2018-07-13T00:00:00
db:BIDid:93806date:2016-10-20T00:00:00
db:JVNDBid:JVNDB-2016-005558date:2016-10-24T00:00:00
db:CNNVDid:CNNVD-201610-696date:2016-10-25T00:00:00
db:NVDid:CVE-2016-6552date:2018-07-13T20:29:00.643