In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism.
Published 2017-12-20 22:29:00
Updated 2019-10-09 23:28:16
Source Rapid7, Inc.
View at NVD,   CVE.org
Vulnerability category: BypassGain privilege

Exploit prediction scoring system (EPSS) score for CVE-2017-5254

90.30%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2017-5254

  • Cambium ePMP 1000 Account Password Reset
    First seen: 2020-04-26
    auxiliary/scanner/http/epmp1000_reset_pass
    This module exploits an access control vulnerability in Cambium ePMP device management portal. It requires any one of the following non-admin login credentials - installer/installer, home/home - to reset password of other existing user(s) including 'admin'. A

CVSS scores for CVE-2017-5254

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.0
HIGH AV:N/AC:L/Au:S/C:C/I:C/A:C
8.0
10.0
NIST
8.8
HIGH CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
2.8
5.9
NIST

CWE ids for CVE-2017-5254

  • The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
    Assigned by: nvd@nist.gov (Primary)
  • The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
    Assigned by: cve@rapid7.con (Secondary)

References for CVE-2017-5254

Products affected by CVE-2017-5254

This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!