PT-2022-23307 · Airspan · Airspan Airvelocity 1500

Published 2022-08-16 · Updated 2022-08-17 · CVE-2022-36311

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Airspan AirVelocity 1500 versions prior to 15.18.00.2511

Description The issue is related to injection leading to XSS in the SNMP community field in the eNodeB's web management UI. This may also affect other AirVelocity and AirSpeed models.

Recommendations For Airspan AirVelocity 1500 versions prior to 15.18.00.2511, update to software version 15.18.00.2511 or later to resolve the issue. As a temporary workaround, consider restricting access to the SNMP community field in the eNodeB's web management UI to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-36311

Affected Products

Airspan Airvelocity 1500

References · 4

• https://osv.dev/vulnerability/CVE-2022-36311 · Vendor Advisory
• https://helpdesk.airspan.com/browse/TRN3-1694 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36311 · Security Note
• https://t.me/cibsecurity/48201 · Telegram Post