PT-2022-23306 · Airspan · Airvelocity 1500

Vladionescu · Published 2022-08-16 · Updated 2022-08-17 · CVE-2022-36310

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Airspan AirVelocity 1500 software prior to version 15.18.00.2511

Description The issue allows an attacker with SNMP write abilities to execute commands as root on the eNodeB due to NET-SNMP-EXTEND-MIB being enabled on its snmpd service. This may also affect other AirVelocity and AirSpeed models.

Recommendations For Airspan AirVelocity 1500 software prior to version 15.18.00.2511, update to version 15.18.00.2511 or later to resolve the issue. As a temporary workaround, consider disabling the NET-SNMP-EXTEND-MIB on the snmpd service to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-242

Related Identifiers

CVE-2022-36310

GHSA-WHC6-2989-42XM

Affected Products

Airvelocity 1500

References · 5

• 🔥 https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-whc6-2989-42xm · Exploit
• https://helpdesk.airspan.com/browse/TRN3-1689 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36310 · Security Note
• https://osv.dev/vulnerability/CVE-2022-36310 · Vendor Advisory
• https://t.me/cibsecurity/48196 · Telegram Post