CVE-2017-5255CWE-78

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any…

published December 20, 2017

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.5th percentile for exploit probability.

CVSS
—
EPSS
74%
Percentile
99.5
In the wild
Unconfirmed
What it is

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.74233 · 99.5th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2017-12-20T22:00Z
EPSS history
Timeline
  • 20 DEC 22:00Z
    In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any…
    cvelistv5