PT-2022-23301 · Unknown · Airvelocity 1500

Tchebb + 1 · Published 2022-08-16 · Updated 2022-08-17 · CVE-2022-36306

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AirVelocity 1500 versions 9.3.0.01249 through 15.18.00.2511

Description An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file.

Recommendations For AirVelocity 1500 versions 9.3.0.01249 through 15.18.00.2511, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Files Accessible to External Parties

Weakness Enumeration

CWE-219

CWE-552

Related Identifiers

CVE-2022-36306

GHSA-9V93-3QPC-HXJ9

Affected Products

Airvelocity 1500

References · 5

• 🔥 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-9v93-3qpc-hxj9 · Exploit
• https://helpdesk.airspan.com/browse/TRN3-1691 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36306 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36306 · Vendor Advisory
• https://t.me/cibsecurity/48199 · Telegram Post