CVE-2017-5262
HighSummary
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID reference.
Risk Assessment
Access to sensitive information may lead to privacy breaches and data security issues within the organization.
Recommendation
It is recommended to update the firmware to the latest version to mitigate this vulnerability.
Other vulnerabilities in Cambium Networks cnPilot firmware
See all- CVE-2017-5263High
Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks. The absence of these protections exposes web applications to unauthorized actions, especially destructive ones.
- CVE-2017-5261High
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users.
- CVE-2017-5260High
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the configuration file is accessible to the 'user' account via direct object reference, even though this option is not available in the normal web administrative console.
- CVE-2017-5259High
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.
Original NVD description (English source)
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID reference.