CVE-2016-10305
Estado: ModificadaCrítica (9.8)—
Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
CVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Puntuación base: 9.8
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 1.70%
- Percentil entre todas las CVEs puntuadas: 76
- Fecha de la puntuación: 4/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (11)
Gotrango — Apex FirmwareGotrango — Apex Lynx FirmwareGotrango — Apex Orion FirmwareGotrango — Apex Plus FirmwareGotrango — Giga FirmwareGotrango — Giga Lynx FirmwareGotrango — Giga Orion FirmwareGotrango — Giga Plus FirmwareGotrango — Giga PRO FirmwareGotrango — Stratalink FirmwareGotrango — Stratalink PRO Firmware
CWE
- CWE-798
Referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2016-10305",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 10,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"authentication": "NONE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": true,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 9.8,
"attackVector": "NETWORK",
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 3.9
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2017-03-30T07:59:00.143",
"references": [
{
"url": "http://blog.iancaling.com/post/153011925478",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://blog.iancaling.com/post/153011925478",
"tags": [
"Exploit",
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-798"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it."
},
{
"lang": "es",
"value": "Dispositivos Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0 y StrataPro tienen incorporada, una cuenta root oculta, con una contraseña predeterminada que se almacenó una vez en texto plano dentro de un paquete de actualización de software en un servidor FTP Trango. Esta cuenta es accesible a través de SSH y/o TELNET, y otorga acceso al SO UNIX incrustado subyacente en el dispositivo, permitiendo un control total sobre él."
}
],
"lastModified": "2026-06-17T00:39:26.807",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:apex_plus_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F84A440B-2E1B-4523-A9C6-B778B3A30AA3",
"versionEndIncluding": "3.2.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:apex_plus:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "69FAFD6E-6468-4ADE-8A39-691C7A7533F2"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:apex_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "78A2B277-3E1E-4E7B-AF71-66A34D2C01E3",
"versionEndIncluding": "2.1.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:apex:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "87CC256C-0BBC-4CC6-B3FD-290FEE54706D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:apex_lynx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "00512E13-C1D3-4793-8E87-308740B15194",
"versionEndIncluding": "1.2.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:apex_lynx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "94B74AD7-9928-4A3F-9F1A-77DDE3146850"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:apex_orion_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "020DC4B1-A142-4283-A2F8-959551DAE16A",
"versionEndIncluding": "1.2.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:apex_orion:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "8B6CA0D9-5287-4989-A542-E3CAE49E65A0"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:giga_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "879F29DD-E1DC-4E54-8E56-A3FDB4F1DFEA",
"versionEndIncluding": "2.6.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:giga:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "70AE032B-D83F-4517-B152-BD7ADF37BBBB"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:giga_lynx_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E3D89190-B932-485C-9CDE-F135FB4EC1E8",
"versionEndIncluding": "1.2.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:giga_lynx:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B8A34573-5D38-43D6-ACF8-206421EA6F76"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:giga_orion_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "31D81761-306C-4D89-879A-2908D635BE79",
"versionEndIncluding": "1.2.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:giga_orion:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6AFA74FA-51EF-4C0D-B917-2AB122661CB8"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:giga_plus_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F47D4241-B0AF-464F-8C40-3BA12D0AC95B",
"versionEndIncluding": "3.2.3"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:giga_plus:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "971E87B9-94AE-4E19-8FBB-DB9ED38AF6D3"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:giga_pro_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7903E3E5-FD78-4BD3-82FA-BCE740098A10",
"versionEndIncluding": "1.4.1"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:giga_pro:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "71ED9425-67B3-47E1-86D1-174E83F883F4"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:stratalink_pro_firmware:-:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "20BBBD39-BDB1-48D6-8D5E-A468C65E9B64"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:stratalink_pro:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "4A6F6218-B0FD-430C-BCF9-E6CBE7EF348D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:gotrango:stratalink_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "271E0BBA-BF1A-41BE-ADBC-FE38E39F91C6",
"versionEndIncluding": "2.2.0"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:gotrango:stratalink:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "83525154-B19E-48D6-AAF5-03480548C304"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}