← Back

CVE-2016-1561

nvd nist
Published: Apr 21, 2017Modified: May 13, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

ExaGrid appliances with firmware before 4.8 P26 have a default SSH public key in the authorized_keys file for root, which allows remote attackers to obtain SSH access by leveraging knowledge of a private key from another installation or a firmware image.

Affected (8)

Exagrid
8 products
Ex3000 Firmware
Ex5000 Firmware
Ex7000 Firmware
Ex10000e Firmware
Ex13000e Firmware
Ex21000e Firmware
Ex32000e Firmware
Ex40000e Firmware
Configuration A
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ex3000 Firmware
Version 4.8
Running on/withPlatform Versions
Exagrid
Ex3000
All versions
Configuration B
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ex5000 Firmware
Version 4.8
Running on/withPlatform Versions
Exagrid
Ex5000
All versions
Configuration C
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ex7000 Firmware
Version 4.8
Running on/withPlatform Versions
Exagrid
Ex7000
All versions
Configuration D
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ex10000e Firmware
Version 4.8
Running on/withPlatform Versions
Exagrid
Ex10000e
All versions
Configuration E
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ex13000e Firmware
Version 4.8
Running on/withPlatform Versions
Exagrid
Ex13000e
All versions
Configuration F
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ex21000e Firmware
Version 4.8
Running on/withPlatform Versions
Exagrid
Ex21000e
All versions
Configuration G
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ex32000e Firmware
Version 4.8
Running on/withPlatform Versions
Exagrid
Ex32000e
All versions
Configuration H
1 vulnerable · 1 platform
Vulnerable SoftwareAffected Versions
Ex40000e Firmware
Version 4.8
Running on/withPlatform Versions
Exagrid
Ex40000e
All versions

Related CWEs

CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (6)

Source: cret@cert.org
ExploitThird Party AdvisoryVDB Entry
Source: cret@cert.org
Third Party Advisory
Source: cret@cert.org
ExploitMitigationThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitThird Party AdvisoryVDB Entry
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitMitigationThird Party Advisory

Timeline

No history available yet.