CVE-2017-5260CWE-472

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web…

published December 20, 2017

CVSS
—
EPSS
8%
Percentile
94.8
In the wild
Unconfirmed
What it is

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.08133 · 94.8th percentile
Weakness
CWE-472 · External Control of Assumed-Immutable Web Parameter
Published
2017-12-20T22:00Z
EPSS history
Timeline
  • 20 DEC 22:00Z
    In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web…
    cvelistv5