CVE-2017-5259
20.12.2017, 22:29
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.Enginsight
| Vendor | Product | Version |
|---|---|---|
| cambiumnetworks | cnpilot_r190v_firmware | 𝑥 ≤ 4.3.2-r4 |
| cambiumnetworks | cnpilot_e410_firmware | 𝑥 ≤ 4.3.2-r4 |
| cambiumnetworks | cnpilot_r190n_firmware | 𝑥 ≤ 4.3.2-r4 |
| cambiumnetworks | cnpilot_e400_firmware | 𝑥 ≤ 4.3.2-r4 |
| cambiumnetworks | cnpilot_e600_firmware | 𝑥 ≤ 4.3.2-r4 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-489 - Active Debug CodeThe application is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
- CWE-319 - Cleartext Transmission of Sensitive InformationThe software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.