CVE-2016-10308: Siklu Etherhaul Firmware

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

Siklu EtherHaul radios before 3.7.1 and 6.x before 6.9.0 have a built-in, hidden root account, with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface and grants access to the underlying embedded Linux OS on the device, allowing full control over it.

Affected products

• Siklu Etherhaul Firmware: up to and including 3.7.0; version 6.0 only

Published 2017-03-30. Last modified 2026-06-17.