CVE-2017-5255

2017-12-2022:00:00

CWE-78

rapid7

www.cve.org

AI Score

8.7

Confidence

High

EPSS

0.208

Percentile

96.5%

JSON

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root.

CNA Affected

[
  {
    "product": "ePMP",
    "vendor": "Cambium Networks",
    "versions": [
      {
        "status": "affected",
        "version": "3.5 and prior"
      }
    ]
  }
]