var-201712-0219
Vulnerability from variot

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http:///goform/down_cfg_file by this otherwise low privilege 'user' account. Cambium Networks cnPilot Vulnerabilities related to environment settings exist in the firmware.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. CambiumNetworkscnPilot is a cloud-managed single-frequency router product from Cambium Networks Inc. There is a security vulnerability in CambiumNetworkscnPilot using 4.3.2-R4 and previous firmware. An attacker can use this vulnerability to gain access to the administrator's password with direct object references, which in turn controls the device and the entire WiFi network

Show details on source website

To clipboard 

{
  "@context": {
    "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
    "affected_products": {
      "@id": "https://www.variotdbs.pl/ref/affected_products"
    },
    "configurations": {
      "@id": "https://www.variotdbs.pl/ref/configurations"
    },
    "credits": {
      "@id": "https://www.variotdbs.pl/ref/credits"
    },
    "cvss": {
      "@id": "https://www.variotdbs.pl/ref/cvss/"
    },
    "description": {
      "@id": "https://www.variotdbs.pl/ref/description/"
    },
    "exploit_availability": {
      "@id": "https://www.variotdbs.pl/ref/exploit_availability/"
    },
    "external_ids": {
      "@id": "https://www.variotdbs.pl/ref/external_ids/"
    },
    "iot": {
      "@id": "https://www.variotdbs.pl/ref/iot/"
    },
    "iot_taxonomy": {
      "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
    },
    "patch": {
      "@id": "https://www.variotdbs.pl/ref/patch/"
    },
    "problemtype_data": {
      "@id": "https://www.variotdbs.pl/ref/problemtype_data/"
    },
    "references": {
      "@id": "https://www.variotdbs.pl/ref/references/"
    },
    "sources": {
      "@id": "https://www.variotdbs.pl/ref/sources/"
    },
    "sources_release_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_release_date/"
    },
    "sources_update_date": {
      "@id": "https://www.variotdbs.pl/ref/sources_update_date/"
    },
    "threat_type": {
      "@id": "https://www.variotdbs.pl/ref/threat_type/"
    },
    "title": {
      "@id": "https://www.variotdbs.pl/ref/title/"
    },
    "type": {
      "@id": "https://www.variotdbs.pl/ref/type/"
    }
  },
  "@id": "https://www.variotdbs.pl/vuln/VAR-201712-0219",
  "affected_products": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "model": "cnpilot e410",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      },
      {
        "model": "cnpilot r190v",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      },
      {
        "model": "cnpilot e400",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      },
      {
        "model": "cnpilot r190n",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      },
      {
        "model": "cnpilot e600",
        "scope": "lte",
        "trust": 1.0,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      },
      {
        "model": "cnpilot e400",
        "scope": null,
        "trust": 0.8,
        "vendor": "cambium",
        "version": null
      },
      {
        "model": "cnpilot e410",
        "scope": null,
        "trust": 0.8,
        "vendor": "cambium",
        "version": null
      },
      {
        "model": "cnpilot e600",
        "scope": null,
        "trust": 0.8,
        "vendor": "cambium",
        "version": null
      },
      {
        "model": "cnpilot r190n",
        "scope": null,
        "trust": 0.8,
        "vendor": "cambium",
        "version": null
      },
      {
        "model": "cnpilot r190v",
        "scope": null,
        "trust": 0.8,
        "vendor": "cambium",
        "version": null
      },
      {
        "model": "networks cnpilot \u003c=4.3.2-r4",
        "scope": null,
        "trust": 0.6,
        "vendor": "cambium",
        "version": null
      },
      {
        "model": "cnpilot r190v",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      },
      {
        "model": "cnpilot e600",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      },
      {
        "model": "cnpilot e410",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      },
      {
        "model": "cnpilot r190n",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      },
      {
        "model": "cnpilot e400",
        "scope": "eq",
        "trust": 0.6,
        "vendor": "cambiumnetworks",
        "version": "4.3.2-r4"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5260"
      }
    ]
  },
  "configurations": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/configurations#",
      "children": {
        "@container": "@list"
      },
      "cpe_match": {
        "@container": "@list"
      },
      "data": {
        "@container": "@list"
      },
      "nodes": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "cpe_match": [
              {
                "cpe22Uri": "cpe:/o:cambium_networks:cnpilot_e400_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:cambium_networks:cnpilot_e410_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:cambium_networks:cnpilot_e600_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:cambium_networks:cnpilot_r190n_firmware",
                "vulnerable": true
              },
              {
                "cpe22Uri": "cpe:/o:cambium_networks:cnpilot_r190v_firmware",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      }
    ]
  },
  "cve": "CVE-2017-5260",
  "cvss": {
    "@context": {
      "cvssV2": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
      },
      "cvssV3": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
      },
      "severity": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/cvss/severity#"
        },
        "@id": "https://www.variotdbs.pl/ref/cvss/severity"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        },
        "@id": "https://www.variotdbs.pl/ref/sources"
      }
    },
    "data": [
      {
        "cvssV2": [
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "nvd@nist.gov",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CVE-2017-5260",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 1.8,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "CNVD",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "CNVD-2018-01040",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.6,
            "vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
            "version": "2.0"
          },
          {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "SINGLE",
            "author": "VULHUB",
            "availabilityImpact": "COMPLETE",
            "baseScore": 9.0,
            "confidentialityImpact": "COMPLETE",
            "exploitabilityScore": 8.0,
            "id": "VHN-113463",
            "impactScore": 10.0,
            "integrityImpact": "COMPLETE",
            "severity": "HIGH",
            "trust": 0.1,
            "vectorString": "AV:N/AC:L/AU:S/C:C/I:C/A:C",
            "version": "2.0"
          }
        ],
        "cvssV3": [
          {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "author": "nvd@nist.gov",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "exploitabilityScore": 2.8,
            "id": "CVE-2017-5260",
            "impactScore": 5.9,
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "trust": 1.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        ],
        "severity": [
          {
            "author": "nvd@nist.gov",
            "id": "CVE-2017-5260",
            "trust": 1.0,
            "value": "HIGH"
          },
          {
            "author": "NVD",
            "id": "CVE-2017-5260",
            "trust": 0.8,
            "value": "High"
          },
          {
            "author": "CNVD",
            "id": "CNVD-2018-01040",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "CNNVD",
            "id": "CNNVD-201701-407",
            "trust": 0.6,
            "value": "HIGH"
          },
          {
            "author": "VULHUB",
            "id": "VHN-113463",
            "trust": 0.1,
            "value": "HIGH"
          }
        ]
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113463"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5260"
      }
    ]
  },
  "description": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/description#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the \u0027user\u0027 account, the configuration file is accessible via direct object reference (DRO) at http://\u003cdevice-ip-or-hostname\u003e/goform/down_cfg_file by this otherwise low privilege \u0027user\u0027 account. Cambium Networks cnPilot Vulnerabilities related to environment settings exist in the firmware.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. CambiumNetworkscnPilot is a cloud-managed single-frequency router product from Cambium Networks Inc. There is a security vulnerability in CambiumNetworkscnPilot using 4.3.2-R4 and previous firmware. An attacker can use this vulnerability to gain access to the administrator\u0027s password with direct object references, which in turn controls the device and the entire WiFi network",
    "sources": [
      {
        "db": "NVD",
        "id": "CVE-2017-5260"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113463"
      }
    ],
    "trust": 2.25
  },
  "external_ids": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "db": "NVD",
        "id": "CVE-2017-5260",
        "trust": 3.1
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734",
        "trust": 0.8
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-407",
        "trust": 0.7
      },
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040",
        "trust": 0.6
      },
      {
        "db": "VULHUB",
        "id": "VHN-113463",
        "trust": 0.1
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113463"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5260"
      }
    ]
  },
  "id": "VAR-201712-0219",
  "iot": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": true,
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113463"
      }
    ],
    "trust": 1.7
  },
  "iot_taxonomy": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "category": [
          "Network device"
        ],
        "sub_category": null,
        "trust": 0.6
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      }
    ]
  },
  "last_update_date": "2024-11-23T22:59:08.562000Z",
  "patch": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/patch#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "title": "Top Page",
        "trust": 0.8,
        "url": "https://www.cambiumnetworks.com/"
      },
      {
        "title": "Patch for CambiumNetworkscnPilot Direct Object Reference Privilege Escalation Vulnerability",
        "trust": 0.6,
        "url": "https://www.cnvd.org.cn/patchInfo/show/113519"
      },
      {
        "title": "Cambium Networks cnPilot Security vulnerabilities",
        "trust": 0.6,
        "url": "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=99613"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      }
    ]
  },
  "problemtype_data": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "problemtype": "CWE-732",
        "trust": 1.1
      },
      {
        "problemtype": "CWE-472",
        "trust": 1.0
      },
      {
        "problemtype": "CWE-16",
        "trust": 0.9
      }
    ],
    "sources": [
      {
        "db": "VULHUB",
        "id": "VHN-113463"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5260"
      }
    ]
  },
  "references": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/references#",
      "data": {
        "@container": "@list"
      },
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": [
      {
        "trust": 3.1,
        "url": "https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/"
      },
      {
        "trust": 0.8,
        "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-5260"
      },
      {
        "trust": 0.8,
        "url": "https://nvd.nist.gov/vuln/detail/cve-2017-5260"
      }
    ],
    "sources": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113463"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5260"
      }
    ]
  },
  "sources": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "db": "VULHUB",
        "id": "VHN-113463"
      },
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      },
      {
        "db": "NVD",
        "id": "CVE-2017-5260"
      }
    ]
  },
  "sources_release_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-01-16T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "date": "2017-12-20T00:00:00",
        "db": "VULHUB",
        "id": "VHN-113463"
      },
      {
        "date": "2018-01-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "date": "2017-01-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      },
      {
        "date": "2017-12-20T22:29:00.557000",
        "db": "NVD",
        "id": "CVE-2017-5260"
      }
    ]
  },
  "sources_update_date": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
      "data": {
        "@container": "@list"
      }
    },
    "data": [
      {
        "date": "2018-01-16T00:00:00",
        "db": "CNVD",
        "id": "CNVD-2018-01040"
      },
      {
        "date": "2019-10-09T00:00:00",
        "db": "VULHUB",
        "id": "VHN-113463"
      },
      {
        "date": "2018-01-25T00:00:00",
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      },
      {
        "date": "2019-10-17T00:00:00",
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      },
      {
        "date": "2024-11-21T03:27:23.103000",
        "db": "NVD",
        "id": "CVE-2017-5260"
      }
    ]
  },
  "threat_type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "remote",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      }
    ],
    "trust": 0.6
  },
  "title": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/title#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "Cambium Networks cnPilot Vulnerabilities related to environmental settings",
    "sources": [
      {
        "db": "JVNDB",
        "id": "JVNDB-2017-011734"
      }
    ],
    "trust": 0.8
  },
  "type": {
    "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/type#",
      "sources": {
        "@container": "@list",
        "@context": {
          "@vocab": "https://www.variotdbs.pl/ref/sources#"
        }
      }
    },
    "data": "configuration error",
    "sources": [
      {
        "db": "CNNVD",
        "id": "CNNVD-201701-407"
      }
    ],
    "trust": 0.6
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.