Lucene search

[email protected]CVE-2022-21196

HistoryFeb 18, 2022 - 6:15 p.m.

CVE-2022-21196

2022-02-1818:15:12

CWE-287

CWE-285

[email protected]

web.nvd.nist.gov

733

cve-2022-21196

authorization

authentication

remote code execution

dos

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.3%

JSON

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.

Affected configurations

NVD

Node

airspanmimosa_management_platformRange<1.0.3

Node

airspanc6x_firmwareRange<2.8.6.1

AND

airspanc6xMatch-

Node

airspanc5x_firmwareRange<2.8.6.1

AND

airspanc5xMatch-

Node

airspanc5c_firmwareRange<2.8.6.1

AND

airspanc5cMatch-

Node

airspana5x_firmwareRange<2.5.4.1

AND

airspana5xMatch-

CPENameOperatorVersion
airspan:mimosa_management_platformairspan mimosa management platformlt1.0.3

CPE	Name	Operator	Version
airspan:mimosa_management_platform	airspan mimosa management platform	lt	1.0.3

CNA Affected

[
  {
    "product": "MMP",
    "vendor": "Airspan Networks",
    "versions": [
      {
        "lessThan": "v1.0.3",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "PTP C-series",
    "vendor": "Airspan Networks",
    "versions": [
      {
        "lessThan": "v2.8.6.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  },
  {
    "product": "PTMP C-series and A5x",
    "vendor": "Airspan Networks",
    "versions": [
      {
        "lessThan": "v2.5.4.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-034-02

10 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.8 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

73.3%

JSON

Related for CVE-2022-21196

nvd1 cnvd1 prion1 cvelist1 ics1