Airspan
10 CVEs across 22 Airspan products. Browse Airspan vulnerabilities, severities, and proof-of-concept exploits.
Airspan products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-36312 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and A… |
CVE-2022-36311 | Medium | 6.1 | 2022-08-16 | Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in the eNodeB's web mana… |
CVE-2022-36310 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abi… |
CVE-2022-36309 | High | 8.8 | 2022-08-16 | Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit… |
CVE-2022-36308 | Critical | 9.1 | 2022-08-16 | Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials… |
CVE-2022-36307 | Medium | 6.8 | 2022-08-16 | The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 software version 15.18.00… |
CVE-2022-36306 | Medium | 6.5 | 2022-08-16 | An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and th… |
CVE-2022-36267 | Critical | 9.8 | 2022-08-08 | In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called… |
CVE-2022-36266 | Medium | 6.1 | 2022-08-08 | In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. As the binary file /home/www/cgi-bin/login.cgi does not check if t… |
CVE-2022-36265 | High | 7.2 | 2022-08-08 | In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Hidden system command web page. After performing a reverse engineering of the firmware, it w… |
CVE-2022-36264 | Critical | 9.1 | 2022-08-08 | In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitra… |
CVE-2022-21800 | Medium | 6.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 a… |
CVE-2022-21215 | Critical | 10.0 | 2022-02-18 | This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to… |
CVE-2022-21196 | Critical | 10.0 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perfo… |
CVE-2022-21176 | High | 8.6 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not prope… |
CVE-2022-21143 | High | 7.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not prope… |
CVE-2022-21141 | Critical | 10.0 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perfo… |
CVE-2022-0138 | High | 7.5 | 2022-02-18 | MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserial… |
CVE-2008-1543 | | 2008-03-28 | The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it… | |
CVE-2008-1542 | | 2008-03-28 | Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative acce… | |
CVE-2008-1262 | | 2008-03-10 | The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication credentials, which allows remote attacker… |