high8.8
CVE-2017-5259
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path …
Impact
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Cambiumnetworks | Cnpilot R190v Firmware | through 4.3.2-r4 |
| Cambiumnetworks | Cnpilot E410 Firmware | through 4.3.2-r4 |
| Cambiumnetworks | Cnpilot R190n Firmware | through 4.3.2-r4 |
| Cambiumnetworks | Cnpilot E400 Firmware | through 4.3.2-r4 |
| Cambiumnetworks | Cnpilot E600 Firmware | through 4.3.2-r4 |