CVE-2022-1362 Cambium Networks cnMaestro OS Command Injection

2022-05-1720:19:35

CWE-78

icscert

www.cve.org

cve-2022-1362

cambium networks

on-premise

cnmaestro

command injection

vulnerability

arbitrary commands

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

EPSS

Percentile

12.7%

JSON

The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server.

CNA Affected

[
  {
    "product": "cnMaestro",
    "vendor": "Cambium Networks",
    "versions": [
      {
        "lessThan": "3.0.3-r32",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "2.4.2-r29",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "3.0.0-r34",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]