CVE-2016-1560: ExaGrid appliances default root and support credentials allow admin access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or interaction required, publicly available exploit tooling, and very high EPSS probability make this trivially exploitable for full administrative compromise.

What it is

ExaGrid appliances running firmware before 4.8 P26 ship with a default password of 'inflection' for the root shell account and a default password for the support account in the web interface. Because these credentials are static and publicly documented, anyone who can reach the appliance can log in with full administrative rights. This is a hard-coded/default credential flaw (CWE-798) affecting the entire ExaGrid firmware line.

Impact

An attacker gains administrative access to the appliance via SSH or the web interface, exposing backup data, configuration and the underlying system. With root shell access, the appliance can be fully controlled, data can be read, altered or destroyed, and it can be used as a pivot into the backup network.

Attack surface

Reachable over the network through SSH or HTTP sessions to the appliance; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required. Any host that can route to the appliance's management interfaces can attempt the default credentials.

Exploitation

Not listed in CISA KEV, but EPSS is 0.72289 (99.4th percentile) and multiple references are tagged Exploit, including a Rapid7 Metasploit module and a Packet Storm advisory, so public exploitation tooling exists.

What to do

• Upgrade ExaGrid firmware to 4.8 P26 or later, which removes the default credentials.
• Immediately change the root and support account passwords on any appliance that cannot be patched.
• Restrict SSH and web management access to trusted administrative networks using firewall rules or ACLs.
• Disable or rename the support account if it is not required, and audit for any other default accounts.
• Monitor authentication logs for successful logins using the known default credentials.

Detection

• Search SSH and web authentication logs for successful logins to root or support accounts from unexpected source IPs.
• Alert on authentication attempts using the known default password 'inflection' or the support account default.
• Inventory ExaGrid appliances and verify firmware version is 4.8 P26 or later.
• Monitor for new SSH sessions or web admin sessions originating outside the management network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.