CVE-2017-5259
HighSummary
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.
Risk Assessment
The presence of a root-privilege web shell poses a significant security risk, allowing attackers full control over the device.
Recommendation
It is recommended to update the firmware to the latest version to eliminate this vulnerability and to block access to unauthorized administrative interfaces.
Other vulnerabilities in Cambium Networks cnPilot firmware
See all- CVE-2017-5263High
Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks. The absence of these protections exposes web applications to unauthorized actions, especially destructive ones.
- CVE-2017-5262High
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID reference.
- CVE-2017-5261High
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users.
- CVE-2017-5260High
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the configuration file is accessible to the 'user' account via direct object reference, even though this option is not available in the normal web administrative console.
Original NVD description (English source)
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.