CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
50.9%
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Attackers can abuse multiple end-points not protected against cross-site request forgery (CSRF), as a result authenticated users can be persuaded to visit malicious web pages, which allows attackers to perform arbitrary actions, such as downgrade the device’s firmware to older versions, modify configuration, upload arbitrary firmware, exfiltrate files and tokens.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.
Vendor | Product | Version | CPE |
---|---|---|---|
ui | airos | * | cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:* |
ui | ag-hp-2g16 | - | cpe:2.3:h:ui:ag-hp-2g16:-:*:*:*:*:*:*:* |
ui | ag-hp-2g20 | - | cpe:2.3:h:ui:ag-hp-2g20:-:*:*:*:*:*:*:* |
ui | ag-hp-5g23 | - | cpe:2.3:h:ui:ag-hp-5g23:-:*:*:*:*:*:*:* |
ui | ag-hp-5g27 | - | cpe:2.3:h:ui:ag-hp-5g27:-:*:*:*:*:*:*:* |
ui | airgrid_m | - | cpe:2.3:h:ui:airgrid_m:-:*:*:*:*:*:*:* |
ui | airgrid_m2 | - | cpe:2.3:h:ui:airgrid_m2:-:*:*:*:*:*:*:* |
ui | airgrid_m5 | - | cpe:2.3:h:ui:airgrid_m5:-:*:*:*:*:*:*:* |
ui | ar | - | cpe:2.3:h:ui:ar:-:*:*:*:*:*:*:* |
ui | ar-hp | - | cpe:2.3:h:ui:ar-hp:-:*:*:*:*:*:*:* |
[
{
"product": "AirMax AirOS for TI, XW and XM boards",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Affected firmware versions v6.2.0 and prior"
},
{
"status": "affected",
"version": "Fixed firmware version v6.3.0"
}
]
}
]
community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83
community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83%2C
community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8
community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8%2C
www.ui.com/download/airmax-m
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:P/I:P/A:P
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
50.9%