PT-2022-23303 · Airspan · Airspan Airvelocity 1500

Vladionescu · Published 2022-08-16 · Updated 2022-08-17 · CVE-2022-36308

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Airspan AirVelocity 1500 versions prior to 15.18.00.2511

Description The web management UI of the affected software displays SNMP credentials in plaintext and stores SNMPv3 credentials unhashed on the filesystem. This allows anyone with web access to use these credentials to manipulate the eNodeB over SNMP. The issue may also affect other AirVelocity and AirSpeed models.

Recommendations For versions prior to 15.18.00.2511, update to version 15.18.00.2511 or later to resolve the issue. As a temporary workaround, consider restricting web access to the management UI to minimize the risk of exploitation.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

CWE-256

Related Identifiers

CVE-2022-36308

GHSA-QJGC-RX8M-Q58X

Affected Products

Airspan Airvelocity 1500

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-36308 · Security Note
• https://helpdesk.airspan.com/browse/TRN3-1692 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-36308 · Vendor Advisory
• https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-qjgc-rx8m-q58x · Note
• https://t.me/cibsecurity/48202 · Telegram Post