high8.8Public exploit code
CVE-2017-5255
In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenti…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Cambium ePMP1000 - 'get_chart' Shell via Command Injection (Metasploit)2018-01-01 · remote · cgi · Verified
Impact
In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cambiumnetworks | Epmp 1000 Firmware | through 3.5 |
| Cambiumnetworks | Epmp 2000 Firmware | through 3.5 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
- https://www.exploit-db.com/exploits/43413/
- https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
- https://www.exploit-db.com/exploits/43413/