Vulnerability · Published May 17, 2022 · Assigned by icscert

CVE-2022-1359Cambium Networks cnMaestro Path Traversal

Medium 5.7

In plain English

A medium-severity OS command injection in cnMaestro from Cambium Networks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 63% of all known vulnerabilities).

Severity (CVSS 3.1)5.7Medium

Exploit odds (30 days)1.0%top 37.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The affected On-Premise cnMaestro is vulnerable to an arbitrary file-write through improper limitation of a pathname to a restricted directory inside a specific route. If an attacker supplied path traversal charters (../) as part of a filename, the server will save the file where the attacker chooses. This could allow an attacker to write any data to any file in the server.

Affected products (as reported)

Vendor	Product	Versions
Cambium Networks	cnMaestro	unspecified – before 3.0.3-r32unspecified – before 2.4.2-r29unspecified – before 3.0.0-r34

Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04 x_refsource_CONFIRM