CVE-2015-0936: Ceragon FibeAir IP-10 hardcoded SSH key grants remote access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, a publicly known private key, and public exploit tooling make this trivially exploitable against exposed devices.

What it is

Ceragon FibeAir IP-10 firmware ships a default SSH public key in the authorized_keys file for the mateidu user. Because the matching private key is publicly known, anyone with that key can authenticate to the device over SSH. This is a hardcoded credential flaw (CWE-320) in a network-facing appliance.

Impact

An attacker gains SSH access as the mateidu user, and with the CVSS vector scoring confidentiality, integrity and availability all High, that access can lead to full compromise of the device. The appliance sits in the network path, so compromise can expose or disrupt traffic it handles.

Attack surface

Reachable over the network via SSH (AV:N, PR:N, UI:N); no authentication or user interaction is required because the attacker supplies the known private key. Any FibeAir IP-10 with the default authorized_keys entry and SSH exposed is a candidate.

Exploitation

Not listed in CISA KEV, but EPSS is 0.7809 (99.55th percentile) and multiple references are tagged Exploit, including a Rapid7 Metasploit module, indicating public exploit tooling exists.

What to do

• Patch or upgrade FibeAir IP-10 firmware to a vendor release that removes the default mateidu authorized_keys entry.
• If no patch is available, remove the mateidu key from authorized_keys and disable or restrict the mateidu account.
• Restrict SSH access to a management network or trusted hosts and block it from untrusted networks.
• Rotate any credentials or keys that may have been exposed through prior unauthorized SSH access.
• Monitor vendor advisories for updated guidance on affected firmware versions.

Detection

• Audit authorized_keys files on FibeAir IP-10 devices for the mateidu key and remove unexpected entries.
• Review SSH authentication logs for successful logins as mateidu or from unusual source addresses.
• Alert on SSH connections to FibeAir management interfaces from outside expected management ranges.
• Hunt for use of the known private key or Rapid7 Metasploit module activity against these devices.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.