Lucene search

IcscertCVELIST:CVE-2022-1357

HistoryMay 17, 2022 - 8:10 p.m.

CVE-2022-1357 Cambium Networks cnMaestro OS Command Injection

2022-05-1720:10:59

CWE-78

icscert

www.cve.org

cve-2022-1357; cambium networks; cnmaestro; os command injection; unauthenticated access; arbitrary code; web server privileges; logger command; validation.

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.002

Percentile

65.0%

JSON

The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web server. This lack of validation could allow an attacker to append arbitrary data to the logger command.

CNA Affected

[
  {
    "product": "cnMaestro",
    "vendor": "Cambium Networks",
    "versions": [
      {
        "lessThan": "3.0.3-r32",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "2.4.2-r29",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "3.0.0-r34",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

www.cisa.gov/uscert/ics/advisories/icsa-22-132-04

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.8

Confidence

High

EPSS

0.002

Percentile

65.0%

JSON

Related for CVELIST:CVE-2022-1357