Critical severity9.8NVD Advisory· Published Mar 30, 2017· Updated Jun 17, 2026
CVE-2016-10305
CVE-2016-10305
Description
Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
Affected products
22cpe:2.3:o:gotrango:apex_firmware:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:o:gotrango:apex_firmware:*:*:*:*:*:*:*:*range: <=2.1.1
- cpe:2.3:o:gotrango:apex_orion_firmware:*:*:*:*:*:*:*:*range: <=1.2.3
- cpe:2.3:o:gotrango:apex_plus_firmware:*:*:*:*:*:*:*:*range: <=3.2.0
cpe:2.3:o:gotrango:stratalink_firmware:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:gotrango:stratalink_firmware:*:*:*:*:*:*:*:*range: <=2.2.0
- (no CPE)range: <3.0
- cpe:2.3:o:gotrango:stratalink_pro_firmware:-:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
1- blog.iancaling.com/post/153011925478nvdExploitThird Party Advisory
News mentions
0No linked articles in our index yet.