PT-2022-13823 · Cambium Networks · Cnmaestro

Noam Moshe · Published 2022-05-17 · Updated 2022-06-06 · CVE-2022-1357

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions cnMaestro (affected versions not specified)

Description The issue allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code with the privileges of the web server. This is due to a lack of validation, which could enable an attacker to append arbitrary data to the logger command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-1357

Affected Products

Cnmaestro

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2022-1357 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1357 · Vendor Advisory
• https://cisa.gov/uscert/ics/advisories/icsa-22-132-04 · Note