FKIE_CVE-2017-5260

Vulnerability from fkie_nvd - Published: 2017-12-20 22:29 - Updated: 2025-04-20 01:37
Severity ?
8.8 (High) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account.
References
cve@rapid7.comhttps://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/Third Party Advisory
Impacted products
Vendor Product Version
cambiumnetworks cnpilot_r190v_firmware *
cambiumnetworks cnpilot_r190v -
cambiumnetworks cnpilot_e410_firmware *
cambiumnetworks cnpilot_e410 -
cambiumnetworks cnpilot_r190n_firmware *
cambiumnetworks cnpilot_r190n -
cambiumnetworks cnpilot_e400_firmware *
cambiumnetworks cnpilot_e400 -
cambiumnetworks cnpilot_e600_firmware *
cambiumnetworks cnpilot_e600 -
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_r190v_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "87AFE671-F9B3-4FCE-B659-BF3EB3623A94",
              "versionEndIncluding": "4.3.2-r4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_r190v:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "B7E6A303-C3EF-46EB-AE4B-C5236CA28B67",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_e410_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "02EB86EE-5DBE-4AFD-9A97-54064EF70B35",
              "versionEndIncluding": "4.3.2-r4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_e410:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "74E7C383-DCE9-4A3B-A410-7C35B9AB2366",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_r190n_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E4DDF69-A4C3-485E-9BB4-33C6322F5F18",
              "versionEndIncluding": "4.3.2-r4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_r190n:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC5D1CBD-0489-4F54-B4A4-EDD1B2FE8A4D",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_e400_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7C6997D-FFDB-4490-9DDD-A7DAACD9431E",
              "versionEndIncluding": "4.3.2-r4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_e400:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "FAFC8235-EF5B-4E8C-8FFD-A0A344C3DEBE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_e600_firmware:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9C30EEBA-96E3-4382-9BE4-C5116EA66923",
              "versionEndIncluding": "4.3.2-r4",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        },
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_e600:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "E4D0A961-FA16-4151-ABA5-5F401ACE27FE",
              "vulnerable": false
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the \u0027user\u0027 account, the configuration file is accessible via direct object reference (DRO) at http://\u003cdevice-ip-or-hostname\u003e/goform/down_cfg_file by this otherwise low privilege \u0027user\u0027 account."
    },
    {
      "lang": "es",
      "value": "En versiones de firmware 4.3 2-R4 y anteriores de Cambium Networks cnPilot, aunque la opci\u00f3n para acceder al archivo de configuraci\u00f3n no est\u00e1 disponible en la consola de administraci\u00f3n web normal para la cuenta \"user\", se puede acceder al archivo de configuraci\u00f3n mediante DRO (referencia de objeto directa) en http:///goform/down_cfg_file por esta cuenta \u0027user\u0027 de privilegios bajos."
    }
  ],
  "id": "CVE-2017-5260",
  "lastModified": "2025-04-20T01:37:25.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 9.0,
          "confidentialityImpact": "COMPLETE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 10.0,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.0"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2017-12-20T22:29:00.557",
  "references": [
    {
      "source": "cve@rapid7.com",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Third Party Advisory"
      ],
      "url": "https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/"
    }
  ],
  "sourceIdentifier": "cve@rapid7.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-472"
        }
      ],
      "source": "cve@rapid7.com",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-732"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.