Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Trango devices expose hidden root account with default password

CVE-2016-10307 · published 9 years ago
Summary

Trango ApexLynx, ApexOrion, GigaLynx, GigaOrion and StrataLink devices contain a hidden administrator account that uses a default password whose hash is publicly known. Anyone who can connect via SSH or Telnet can log in as this account and gain full control of the device's operating system. Update the firmware to a version that removes the hidden account or change the password to a strong, unique one as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gotrango apex_lynx_firmware 2.0
cpe:2.3:o:gotrango:apex_lynx_firmware:2.0:*:*:*:*:*:*:*
gotrango apex_orion_firmware 2.0
cpe:2.3:o:gotrango:apex_orion_firmware:2.0:*:*:*:*:*:*:*
gotrango giga_lynx_firmware 2.0
cpe:2.3:o:gotrango:giga_lynx_firmware:2.0:*:*:*:*:*:*:*
gotrango giga_orion_firmware 2.0
cpe:2.3:o:gotrango:giga_orion_firmware:2.0:*:*:*:*:*:*:*
gotrango stratalink_firmware <= 3.0
cpe:2.3:o:gotrango:stratalink_firmware:*:*:*:*:*:*:*:*
Original advisory text
Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but...
Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account, with a default password for which the MD5 hash value is public (but the cleartext value is perhaps not yet public). This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker full control (estimated)
Severity
9.8 Critical
Exploitation
2% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published30 Mar 2017
Updated29 Oct 2026
First seen29 Sep 2026
Sources
CVE-2016-10307 · NVD
Track software like this
Free during beta