Command injection

2017-03-3007:59:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

Low

0.012 Low

EPSS

Percentile

85.6%

JSON

Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device’s web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.

CPENameOperatorVersion
etherhaul_firmwarele3.7.0
etherhaul_firmwareeq6.0

CPE	Name	Operator	Version
	etherhaul_firmware	le	3.7.0
	etherhaul_firmware	eq	6.0

References

blog.iancaling.com/post/145309944453

www.securityfocus.com/bid/97243