CVE-2016-10115

NETGEAR Arlo base stations with firmware 1.7.5_6178 and earlier, Arlo Q devices with firmware 1.8.0_5551 and earlier, and Arlo Q Plus devices with firmware 1.8.1_6094 and earlier have a default password of 12345678, which makes it easier for remote attackers to obtain access after a factory reset or in a factory configuration.

• CWE-798

• http://blog.newskysecurity.com/2016/09/factory_reset_vuln_in_netgear_arlo/Third Party Advisory
• http://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-VulnerabilityMitigation, Vendor Advisory
• http://www.securityfocus.com/bid/95265Third Party Advisory, VDB Entry
• http://blog.newskysecurity.com/2016/09/factory_reset_vuln_in_netgear_arlo/Third Party Advisory
• http://kb.netgear.com/30731/Arlo-WiFi-Default-Password-Security-VulnerabilityMitigation, Vendor Advisory
• http://www.securityfocus.com/bid/95265Third Party Advisory, VDB Entry

Published

Jan 4, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-10107Unauthenticated Remote Command injection as root occurs in t…
• CVE-2016-10108Unauthenticated Remote Command injection as root occurs in t…
• CVE-2016-10109Use-after-free vulnerability in pcsc-lite before 1.8.20 allo…
• CVE-2016-1011Use-after-free vulnerability in Adobe Flash Player before 18…8.8
• CVE-2016-10112Cross-site scripting (XSS) vulnerability in the WooCommerce …
• CVE-2016-10114SQL injection vulnerability in the "aWeb Cart Watching Syste…
• CVE-2016-10116NETGEAR Arlo base stations with firmware 1.7.5_6178 and earl…
• CVE-2016-10117Firejail does not restrict access to --tmpfs, which allows l…
• CVE-2016-10118Firejail allows local users to truncate /etc/resolv.conf via…
• CVE-2016-10119Firejail uses 0777 permissions when mounting /tmp, which all…
• CVE-2016-1012Adobe Flash Player before 18.0.0.343 and 19.x through 21.x b…8.8
• CVE-2016-10120Firejail uses 0777 permissions when mounting (1) /dev, (2) /…