CVE-2017-5255 In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-p...
HighCVSS 8.8
EPSS 74.2%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cambiumnetworks epmp 1000 firmware | <= 3.5 | No fix listed |
| cambiumnetworks epmp 2000 firmware | <= 3.5 | No fix listed |
| cambium networks ePMP | = 3.5 and prior | No fix listed |
References
- blog.rapid7.com third-party-advisory
- 43413 exploit third-party-advisory vdb-entry