CVE-2016-9495 Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials
Attackers can access Hughes satellite modems via Telnet using shared default credentials, leading to unauthorized control.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-9495?
CVE-2016-9495 is a high-severity vulnerability in Hughes Satellite Modem DW7000, published on 13 Jul 2018. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Hughes high-performance broadband satellite modems, models HN7740S DW7000 HN7000S/SM, uses hard coded credentials. Access to the device's default telnet port (23) can be obtained through using one of a few default credentials shared among all devices.
Weakness: CWE-798
Which versions are affected by CVE-2016-9495?
It affects 4 products.
Products include Hughes Dw7000 Firmware, Hughes Hn7000s Firmware, Hughes Hn7000sm Firmware, Hughes Hn7740s Firmware.
How do I fix CVE-2016-9495?
No fix has been published for CVE-2016-9495 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-9495 being exploited?
There is no known exploitation of CVE-2016-9495 in the wild and no public exploit code.
Other vulnerabilities in Hughes Satellite Modem DW7000
Sources
Also known as GHSA-384v-5m98-7qm4.