CVE-2016-6552

Green Packet DX-350 uses default credentials

published July 13, 2018

CVSS
—
EPSS
3%
Percentile
86.5
In the wild
Unconfirmed
What it is

⚠️ An unchanged default password is like leaving your front door wide open! With the Green Packet DX-350, the default credentials are "root:wimax" — and that makes it a cakewalk for attackers to stroll right in. 🔥 Think of it as a restaurant with a front door unlocked and no host to greet guests. Anyone can walk in and take whatever they want. This means that unauthorized users can access the device as if they were the owner, leading to potential chaos. An attacker can easily gain privileged access to the device, potentially compromising sensitive data or altering configurations. This breach could lead to unauthorized control over devices in your network, creating a very risky environment!

Put simply

Think of it as a restaurant with a front door unlocked and no host to greet guests. Anyone can walk in and take whatever they want. This means that unauthorized users can access the device as if they were the owner, leading to potential chaos. CVE-2016-6552 involves the use of hardcoded, non-random default credentials in the Green Packet DX-350, allowing remote attackers to log in without any prior authentication.

What to do

An attacker can easily gain privileged access to the device, potentially compromising sensitive data or altering configurations. This breach could lead to unauthorized control over devices in your network, creating a very risky environment! To protect against this vulnerability, change the default credentials immediately and enforce strong password policies to prevent unauthorized access. Regularly audit your devices for any potential security weaknesses too! You've got this! Following these steps will solidify your defenses and keep your network secure. 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02842 · 86.5th percentile
Published
2018-07-13T20:00Z
EPSS history
Timeline
  • 13 JUL 20:00Z
    Green Packet DX-350 uses default credentials
    cvelistv5