CVE-2017-5254

High

Published: 20/12/2017(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

In version 3.5 and prior of Cambium Networks ePMP firmware, non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism.

Risk Assessment

The ability for unauthorized users to change passwords poses a serious security risk to the system, potentially leading to unauthorized access to administrative accounts.

Recommendation

It is recommended to update the firmware to the latest version to mitigate this vulnerability and to restrict access to 'installer' and 'home' accounts.

Other vulnerabilities in Cambium Networks ePMP firmware

CVE-2017-5255High
In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows authenticated users, including low-privilege readonly users, to inject shell meta-characters via a specially-crafted POST request to the get_chart function and execute OS-level commands as root.

Original NVD description (English source)

In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS