Path traversal

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users...

Cross site request forgery (csrf)

Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones...

CVE-2017-5259

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https:///adm/syscmd.asp...

CVE-2017-5260

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference DRO at...

CVE-2017-5261

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users...

CVE-2017-5262

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only RO community string has access to sensitive information by OID reference...

CVE-2017-5263

Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones...

CVE-2017-5259

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https:///adm/syscmd.asp...

CVE-2017-5260

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference DRO at...

CVE-2017-5261

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users...

CVE-2017-5262

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only RO community string has access to sensitive information by OID reference...

CVE-2017-5263

Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones...

CVE-2017-5259

Cambium Networks cnPilot firmware versions 4.3.2-R4 and prior contain an undocumented, root-privilege administration web shell . This backdoor is accessible via the HTTP path https:///adm/syscmd.asp. Any authenticated user can exploit this vulnerability to execute arbitrary system commands as the...

CVE-2017-5260

CVE-2017-5260 (Cambium cnPilot) affects cnPilot firmware 4.3.2-R4 and earlier. A low-privilege user can access the device configuration via direct object reference to /goform/down_cfg_file, bypassing normal ACLs. This DRO exposure allows full device configuration data, including sensitive informa...

CVE-2017-5261

The CVE-2017-5261 entry concerns Cambium Networks cnPilot firmware with a file path traversal in the web administrative console’s ping and traceroute functions, affecting 4.3.2-R4 and earlier. Connected documents corroborate practical exploitability: a Metasploit module (Cambium cnPilot r200/r201...

CVE-2017-5262

CVE-2017-5262 affects Cambium Networks cnPilot firmware 4.3.2-R4 and earlier, where the SNMP read-only community string can access sensitive information by OID reference. Public docs describe exploitation via SNMP enumeration (e.g., Metasploit module) that can extract credentials such as username...

CVE-2017-5263

Cambium Networks cnPilot firmware versions 4.3.2-R4 and earlier are affected by a CSRF vulnerability caused by lack of CSRF protection in the web interface. The CNVD entry for CNVD-2018-01037 (and the CVE-2017-5263 record) indicate an attacker could misuse CSRF to obtain or change the administrat...

PT-2017-16427

Name of the Vulnerable Software and Affected Versions Cambium Networks cnPilot firmware versions 4.3.2-R4 and prior Description The issue concerns an undocumented, root-privilege administration web shell accessible via a specific HTTP path. This path is "https:///adm/syscmd.asp". Recommendations...

CVE-2017-5263: Cross-Site Request Forgery (CSRF)

Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones...

CVE-2017-5262: Exposure of Sensitive Information to an Unauthorized Actor

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only RO community string has access to sensitive information by OID reference...