Vulnerability · Published Aug 16, 2022 · Assigned by facebook
CVE-2022-36309
High 8.8
In plain English
A high-severity OS command injection in AirVelocity from Airspan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 25.2% (higher than 98% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)25.2%top 2.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Airspan | AirVelocity | unspecified – before 15.18.00.2511 |
Weakness: CWE-78
References
- https://helpdesk.airspan.com/browse/TRN3-1690 x_refsource_CONFIRM
- https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-p295-2jh6-g6g4 x_refsource_MISC