CVE-2017-5261
HighSummary
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users.
Risk Assessment
This vulnerability may allow attackers to access sensitive system files, potentially leading to further attacks on the network infrastructure.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability and to restrict access to administrative functions to trusted users.
Other vulnerabilities in Cambium Networks cnPilot firmware
See all- CVE-2017-5263High
Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks. The absence of these protections exposes web applications to unauthorized actions, especially destructive ones.
- CVE-2017-5262High
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID reference.
- CVE-2017-5260High
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the configuration file is accessible to the 'user' account via direct object reference, even though this option is not available in the normal web administrative console.
- CVE-2017-5259High
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.
Original NVD description (English source)
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users.