CVE-2016-10305: Gotrango Apex Firmware

Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days.

Trango Apex <= 2.1.1, ApexLynx < 2.0, ApexOrion < 2.0, ApexPlus <= 3.2.0, Giga <= 2.6.1, GigaLynx < 2.0, GigaOrion < 2.0, GigaPlus <= 3.2.3, GigaPro <= 1.4.1, StrataLink < 3.0, and StrataPro devices have a built-in, hidden root account, with a default password that was once stored in cleartext within a software update package on a Trango FTP server. This account is accessible via SSH and/or TELNET, and grants access to the underlying embedded UNIX OS on the device, allowing full control over it.

Affected products

• Gotrango Apex Firmware: up to and including 2.1.1
• Gotrango Apex Lynx Firmware: up to and including 1.2.3
• Gotrango Apex Orion Firmware: up to and including 1.2.3
• Gotrango Apex Plus Firmware: up to and including 3.2.0
• Gotrango Giga Firmware: up to and including 2.6.1
• Gotrango Giga Lynx Firmware: up to and including 1.2.3
• Gotrango Giga Orion Firmware: up to and including 1.2.3
• Gotrango Giga Plus Firmware: up to and including 3.2.3
• Gotrango Giga Pro Firmware: up to and including 1.4.1
• Gotrango Stratalink Firmware: up to and including 2.2.0
• Gotrango Stratalink Pro Firmware: affected versions not specified

Published 2017-03-30. Last modified 2026-06-17.