CVE-2016-2310 : General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with

General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, which allows remote attackers to modify configuration settings via the web interface.

Published 2016-06-09 10:59:00

Updated 2021-03-29 18:06:13

Source ICS-CERT

View at NVD, CVE.org

Products affected by CVE-2016-2310

GE » Multilink Firmware
Versions up to, including, (<=) 5.5.0
cpe:2.3:o:ge:multilink_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » Multilink Ml1200 » Version: N/A
When used together with: GE » Multilink Ml1600 » Version: N/A
When used together with: GE » Multilink Ml2400 » Version: N/A
When used together with: GE » Multilink Ml800 » Version: N/A
When used together with: GE » Multilink Ml810 » Version: N/A
GE » Multilink Firmware
Versions up to, including, (<=) 5.5.0k
cpe:2.3:o:ge:multilink_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: GE » Multilink Ml3000 » Version: N/A
When used together with: GE » Multilink Ml3100 » Version: N/A
When used together with: GE » Multilink Ml810 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2016-2310

EPSS FAQ

0.43%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 74 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2016-2310

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
10.0	HIGH	AV:N/AC:L/Au:N/C:C/I:C/A:C	10.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2016-2310

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-2310

https://ics-cert.us-cert.gov/advisories/ICSA-16-154-01

GE MultiLink Series Hard-coded Credential Vulnerability | CISA
Third Party Advisory;US Government Resource

Jump to

Vulnerability Details : CVE-2016-2310

Products affected by CVE-2016-2310

Exploit prediction scoring system (EPSS) score for CVE-2016-2310

CVSS scores for CVE-2016-2310

CWE ids for CVE-2016-2310

References for CVE-2016-2310