CVE-2022-36308

The CVE-2022-36308 entry affects Airspan AirVelocity 1500 (web management UI). The root cause is that SNMP credentials are exposed: plaintext in the management UI for versions earlier than 15.18.00.2511 and SNMPv3 credentials stored unhashed on the filesystem, enabling anyone with web access to u...

CVE-2022-36308

Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may...

CVE-2022-36307

The CVE-2022-36307 issue affects AirSpeed/AirVelocity devices, notably the AirVelocity 1500, which prints SNMP credentials on the physically accessible serial port during boot. Root cause: credentials exposed via boot-time serial output. Impact: exposure of SNMP credentials; CVSS indicates high c...

CVE-2022-36307

The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00.2511 and may affect other AirVelocity and AirSpeed models...

PT-2022-23302 · Airspeed +1 · Airspeed +1

Name of the Vulnerable Software and Affected Versions: AirVelocity 1500 versions prior to 15.18.00.2511 Other AirVelocity and AirSpeed models affected versions not specified Description: The issue concerns the printing of SNMP credentials on the physically accessible serial port during boot. This...

PT-2022-23307

Name of the Vulnerable Software and Affected Versions Airspan AirVelocity 1500 versions prior to 15.18.00.2511 Description The issue is related to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This may also affect other AirVelocity and AirSpeed models...

PT-2022-23306 · Airspan · Airvelocity 1500

Name of the Vulnerable Software and Affected Versions: Airspan AirVelocity 1500 software prior to version 15.18.00.2511 Description: The issue allows an attacker with SNMP write abilities to execute commands as root on the eNodeB due to NET-SNMP-EXTEND-MIB being enabled on its snmpd service. This...

CVE-2022-36311: Improper Neutralization of Input During Web Page Generation

Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models...

Airspan AirVelocity 1500 安全漏洞

The Airspan AirVelocity 1500 is a revolutionary indoor high-performance small cell from Airspan USA. Designed to bring public access LTE networks to indoor spaces A security vulnerability exists in versions prior to Airspan AirVelocity 1500 15.18.00.2511 that stems from its web management UI...

CVE-2022-36308: Plaintext Storage of a Password

Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may...

DSA-5209-1 net-snmp - security update

Bulletin has no description...

CVE-2022-36310: Use of Inherently Dangerous Function

Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models...

PT-2022-37179 · Net Snmp · Net-Snmp

Name of the Vulnerable Software and Affected Versions: netsnmp affected versions not specified Description: The issue is related to a heap-buffer-overflow read. Technical details include the netsnmp memdup function and the file snmp api fuzzer.c. Recommendations: At the moment, there is no...

net-snmp:snmp_api_fuzzer: Heap-buffer-overflow in netsnmp_memdup

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed Report: https://oss-fuzz.com/testcase?key=4929330605588480 Project: net-snmp Fuzzing Engine: honggfuzz Fuzz Target: snmpapifuzzer Job Type: honggfuzzasannet-snmp Platform Id: linux Crash Type:...

PT-2022-37177

Name of the Vulnerable Software and Affected Versions No specific software or versions are mentioned in the provided description. Description The issue is related to a heap-double-free crash. The crash involves the snmp free pdu function and is triggered by the snmp api fuzzer.c file. There is no...

net-snmp:snmp_api_fuzzer: Heap-double-free in ada_fuzz_header.h

Project: git://git.code.sf.net/p/net-snmp/code https://github.com/net-snmp/net-snmp.git Detailed Report: https://oss-fuzz.com/testcase?key=5357436638199808 Project: net-snmp Fuzzing Engine: honggfuzz Fuzz Target: snmpapifuzzer Job Type: honggfuzzasannet-snmp Platform Id: linux Crash Type:...

[SECURITY] Fedora 36 Update: net-snmp-5.9.3-1.fc36

SNMP Simple Network Management Protocol is a protocol used for network management. The NET-SNMP project includes various SNMP tools: an extensible agent, an SNMP library, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the...

Fedora: Security Advisory for net-snmp (FEDORA-2022-3af7a32fc0)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Ubuntu: Security Advisory (USN-5543-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Vulnerabilities fixed in Net-SNMP

Vulnerabilities have been fixed in Net-SNMP. The vulnerabilities allow an authenticated malicious party to cause a denial-of-service or potentially execute arbitrary code execute arbitrary code with the privileges under which Net-SNMP is running. This requires malicious network traffic must be se...