Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cveRapid7CVE-2017-5263
HistoryDec 20, 2017 - 10:29 p.m.

CVE-2017-5263

2017-12-2022:29:00
CWE-352
rapid7
web.nvd.nist.gov
26
cambium networks
cnpilot
firmware
csrf
csrf attacks
nvd
cve-2017-5263

CVSS2

5.4

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

21.2%

JSON

Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones.

Affected configurations

Nvd
Node
cambiumnetworkscnpilot_r190v_firmwareRange≤4.3.2-r4
AND
cambiumnetworkscnpilot_r190vMatch-
Node
cambiumnetworkscnpilot_e410_firmwareRange≤4.3.2-r4
AND
cambiumnetworkscnpilot_e410Match-
Node
cambiumnetworkscnpilot_r190n_firmwareRange≤4.3.2-r4
AND
cambiumnetworkscnpilot_r190nMatch-
Node
cambiumnetworkscnpilot_e400_firmwareRange≤4.3.2-r4
AND
cambiumnetworkscnpilot_e400Match-
Node
cambiumnetworkscnpilot_e600_firmwareRange≤4.3.2-r4
AND
cambiumnetworkscnpilot_e600Match-
VendorProductVersionCPE
cambiumnetworkscnpilot_r190v_firmware*cpe:2.3:o:cambiumnetworks:cnpilot_r190v_firmware:*:*:*:*:*:*:*:*
cambiumnetworkscnpilot_r190v-cpe:2.3:h:cambiumnetworks:cnpilot_r190v:-:*:*:*:*:*:*:*
cambiumnetworkscnpilot_e410_firmware*cpe:2.3:o:cambiumnetworks:cnpilot_e410_firmware:*:*:*:*:*:*:*:*
cambiumnetworkscnpilot_e410-cpe:2.3:h:cambiumnetworks:cnpilot_e410:-:*:*:*:*:*:*:*
cambiumnetworkscnpilot_r190n_firmware*cpe:2.3:o:cambiumnetworks:cnpilot_r190n_firmware:*:*:*:*:*:*:*:*
cambiumnetworkscnpilot_r190n-cpe:2.3:h:cambiumnetworks:cnpilot_r190n:-:*:*:*:*:*:*:*
cambiumnetworkscnpilot_e400_firmware*cpe:2.3:o:cambiumnetworks:cnpilot_e400_firmware:*:*:*:*:*:*:*:*
cambiumnetworkscnpilot_e400-cpe:2.3:h:cambiumnetworks:cnpilot_e400:-:*:*:*:*:*:*:*
cambiumnetworkscnpilot_e600_firmware*cpe:2.3:o:cambiumnetworks:cnpilot_e600_firmware:*:*:*:*:*:*:*:*
cambiumnetworkscnpilot_e600-cpe:2.3:h:cambiumnetworks:cnpilot_e600:-:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "cnPilot",
    "vendor": "Cambium Networks",
    "versions": [
      {
        "status": "affected",
        "version": "4.3.2-R4 and prior"
      }
    ]
  }
]

Related

cvelist 1
nvd 1
prion 1
cvelist
cvelist
CVE-2017-5263
2017-12-20 22:00:00
nvd
nvd
CVE-2017-5263
2017-12-20 22:29:00
prion
prion
Cross site request forgery (csrf)
2017-12-20 22:29:00

CVSS2

5.4

Attack Vector

ADJACENT_NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:A/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.8

Confidence

High

EPSS

0.001

Percentile

21.2%

JSON
Related for CVE-2017-5263
cvelist1nvd1prion1