Vulnerability · Published Feb 18, 2022 · Assigned by icscert

CVE-2022-21196Airspan Networks Mimosa Improper Authorization

Critical 10.0

In plain English

A critical-severity security flaw in MMP from Airspan Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.7% (higher than 90% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)3.7%top 10.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.

Affected products (as reported)

Vendor	Product	Versions
Airspan Networks	MMP	unspecified – before v1.0.3
Airspan Networks	PTP C-series	unspecified – before v2.8.6.1
Airspan Networks	PTMP C-series and A5x	unspecified – before v2.5.4.1

Weakness: CWE-285 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02 x_refsource_MISC