Auth bypass in Airspan A5x
CVE-2022-21196
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.037 (89.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.037 · newest: 0.037 · change: 0.000
Affected products
Weakness classification (CWE)
References
- www.cisa.gov/uscert/ics/advisories/icsa-22-034-02 (US Government Resource, Third Party Advisory)
Frequently asked questions
- What is CVE-2022-21196?
- CVE-2022-21196 is a critical-severity vulnerability in Airspan A5x, classified under Improper Authorization. CVSS score: 10.0/10. Published 2022-02-18.
- How severe is CVE-2022-21196?
- Critical severity. CVSS v3 base score is 10.0 out of 10.