PT-2017-16426 · Cambium Networks · Epmp

Karn Ganeshen · Published 2017-12-20 · Updated 2019-10-09 · CVE-2017-5258

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cambium Networks ePMP firmware versions prior to 3.5

Description The issue allows an attacker who knows or can guess the RW community string to provide a URL for a configuration file over SNMP with XSS strings in certain SNMP OIDs. The attacker can serve this file via HTTP, and the affected device will perform a configuration restore using the attacker's supplied config file, including the inserted XSS strings.

Recommendations For versions prior to 3.5, update to version 3.5 or later to resolve the issue. As a temporary workaround, consider restricting access to SNMP and limiting the use of the RW community string until a patch is available. Avoid using potentially malicious configuration files from untrusted sources.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2017-5258

Affected Products

Epmp

References · 3

• 🔥 https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2017-5258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5258 · Security Note