CVSS: 9.0EPSS: 36%CPEs: 4EXPL: 1CVE-2017-5255 – Cambium ePMP1000 - 'get_chart' Shell via Command Injection
https://notcve.org/view.php?id=CVE-2017-5255
20 Dec 2017 — In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root. En versiones de firmware 3.5 y anteriores de Cambium Networks ePMP, la falta de saneamiento de valores de entrada para determinados paráme... • https://www.exploit-db.com/exploits/43413 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 1CVE-2017-5258
https://notcve.org/view.php?id=CVE-2017-5258
20 Dec 2017 — In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL for a configuration file over SNMP with XSS strings in certain SNMP OIDs, serve it via HTTP, and the affected device will perform a configuration restore using the attacker's supplied config file, including the inserted XSS strings. En versiones de firmware 3.5 y anteriores de Cambium Networks ePMP, un atacante que sepa o adivine la cadena de comunidad RW (lectura y escrit... • https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2017-5257
https://notcve.org/view.php?id=CVE-2017-5257
20 Dec 2017 — In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW) community string can insert XSS strings in certain SNMP OIDs which will execute in the context of the currently-logged on user. En versiones de firmware 3.5 y anteriores de Cambium Networks ePMP, un atacante que sepa o adivine la cadena de comunidad RW (lectura y escritura) SNMP podría insertar cadenas XSS en determinados OID SNMP que se ejecutarían en el contexto del usuario actualmente c... • https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.4EPSS: 0%CPEs: 4EXPL: 0CVE-2017-5256
https://notcve.org/view.php?id=CVE-2017-5256
20 Dec 2017 — In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System Description fields in the web administration console, and those fields are vulnerable to persistent cross-site scripting (XSS) injection. En versiones de firmware 3.5 y anteriores de Cambium Networks ePMP, todos los usuarios autenticados pueden actualizar los campos Device Name y System Description en la consola de administración web. Esos campos son vulnerables a inyecci... • https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.0EPSS: 85%CPEs: 4EXPL: 0CVE-2017-5254 – Cambium EPMP 1000 Account Password Reset
https://notcve.org/view.php?id=CVE-2017-5254
20 Dec 2017 — In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism. En versiones de firmware 3.5 y anteriores de Cambium Networks ePMP, los usuarios no administrativos "installer" y "home" pueden cambiar contraseñas para otras cuentas, incluyendo la cuenta admin, después de desactivar un mecanismo de protección del lado del cliente. • https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities • CWE-269: Improper Privilege Management CWE-284: Improper Access Control •