In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• cambiumnetworks epmp 1000 firmwareup to 3.5 inclusive
• cambiumnetworks epmp 2000 firmwareup to 3.5 inclusive

Versions reported by the vendor

Affected version ranges reported by the assigning authority (rapid7). Independent of NVD's CPE analysis and usually ahead of it.

• Cambium Networks ePMP

  • 3.5 and prioraffected

Other highest-scoring records for the same primary product.

• CVE-2017-5254In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of chang
  51Plan
• CVE-2017-5258In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string can provide a URL for
  21Monitor
• CVE-2017-5257In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW) community string can
  21Monitor
• CVE-2017-5256In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System De
  21Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

User input is inserted as text into a shell command. The shell may interpret special characters in the input as part of the command.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1const host = req.body.host;2exec("ping -c 1 " + host, onResult);

1const host = req.body.host;2if (!/^[a-z0-9.-]{1,253}$/i.test(host)) return res.sendStatus(400);3execFile("ping", ["-c", "1", host], onResult);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.