Lucene search

FacebookCVE-2022-36310

HistoryAug 16, 2022 - 1:15 a.m.

CVE-2022-36310

2022-08-1601:15:13

CWE-242

facebook

web.nvd.nist.gov

airspan

airvelocity

1500

software

vulnerability

command execution

snmp

nvd

cve-2022-36310

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

47.7%

JSON

Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models.

Affected configurations

Nvd

Node

airspanairvelocity_1500_firmwareRange9.3.0.01249–15.18.00.2511

AND

airspanairvelocity_1500Match-

VendorProductVersionCPE
airspanairvelocity_1500_firmware*cpe:2.3:o:airspan:airvelocity_1500_firmware:*:*:*:*:*:*:*:*
airspanairvelocity_1500-cpe:2.3:h:airspan:airvelocity_1500:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
airspan	airvelocity_1500_firmware	*	cpe:2.3:o:airspan:airvelocity_1500_firmware::::::::
airspan	airvelocity_1500	-	cpe:2.3:h:airspan:airvelocity_1500:-:::::::*

CNA Affected

[
  {
    "product": "AirVelocity",
    "vendor": "Airspan",
    "versions": [
      {
        "lessThan": "15.18.00.2511",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

github.com/metaredteam/external-disclosures/security/advisories/GHSA-whc6-2989-42xm

helpdesk.airspan.com/browse/TRN3-1689

Social References

CVSS3

8.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.8

Confidence

High

EPSS

0.001

Percentile

47.7%

JSON

Related for CVE-2022-36310