CVSS: 9.0EPSS: 0%CPEs: 10EXPL: 0CVE-2017-5260 – Cambium CnPilot R200/r201 Login Scanner And Config Dump
https://notcve.org/view.php?id=CVE-2017-5260
20 Dec 2017 — In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://
CVSS: 8.0EPSS: 0%CPEs: 10EXPL: 0CVE-2017-5262 – Cambium CnPilot R200/r201 SNMP Enumeration
https://notcve.org/view.php?id=CVE-2017-5262
20 Dec 2017 — In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID reference. En versiones de firmware 4.3 2-R4 y anteriores de Cambium Networks cnPilot, la cadena de comunidad de solo lectura SNMP tiene acceso a información sensible por referencia OID. • https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.0EPSS: 0%CPEs: 10EXPL: 0CVE-2017-5263
https://notcve.org/view.php?id=CVE-2017-5263
20 Dec 2017 — Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones. En versiones de firmware 4.3 2-R4 y anteriores de Cambium Networks cnPilot, no tiene controles Cross-Site Request Forgery (CSRF) que puedan mitigar los efectos de los ataques CSRF, los cuales se suelen implementar como tokens pre-sesión... • https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 8.8EPSS: 1%CPEs: 10EXPL: 0CVE-2017-5261 – Cambium CnPilot R200/r201 File Path Traversal
https://notcve.org/view.php?id=CVE-2017-5261
20 Dec 2017 — In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the 'ping' and 'traceroute' functions of the web administrative console expose a file path traversal vulnerability, accessible to all authenticated users. En versiones de firmware 4.3 2-R4 y anteriores de Cambium Networks cnPilot, las funciones 'ping' y 'traceroute' de la consola administrativa web exponen una vulnerabilidad de salto de directorio de archivo, accesible para todos los usuarios autenticados. • https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-472: External Control of Assumed-Immutable Web Parameter •
CVSS: 9.0EPSS: 2%CPEs: 10EXPL: 0CVE-2017-5259 – Cambium CnPilot R200/r201 Command Execution
https://notcve.org/view.php?id=CVE-2017-5259
20 Dec 2017 — In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp. En versiones de firmware 4.3 2-R4 y anteriores de Cambium Networks cnPilot, está disponible un shell web de administración con privilegios root no documentado utilizando la ruta HTTP https:///adm/syscmd.asp. • https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities • CWE-319: Cleartext Transmission of Sensitive Information CWE-489: Active Debug Code •