CVE-2017-5259 : In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.

Published 2017-12-20 22:29:01

Updated 2019-10-09 23:28:17

Source Rapid7, Inc.

View at NVD, CVE.org

Products affected by CVE-2017-5259

Cambiumnetworks » Cnpilot R190v Firmware
Versions up to, including, (<=) 4.3.2-r4
cpe:2.3:o:cambiumnetworks:cnpilot_r190v_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cambiumnetworks » Cnpilot R190v » Version: N/A
Cambiumnetworks » Cnpilot E410 Firmware
Versions up to, including, (<=) 4.3.2-r4
cpe:2.3:o:cambiumnetworks:cnpilot_e410_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cambiumnetworks » Cnpilot E410 » Version: N/A
Cambiumnetworks » Cnpilot R190n Firmware
Versions up to, including, (<=) 4.3.2-r4
cpe:2.3:o:cambiumnetworks:cnpilot_r190n_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cambiumnetworks » Cnpilot R190n » Version: N/A
Cambiumnetworks » Cnpilot E400 Firmware
Versions up to, including, (<=) 4.3.2-r4
cpe:2.3:o:cambiumnetworks:cnpilot_e400_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cambiumnetworks » Cnpilot E400 » Version: N/A
Cambiumnetworks » Cnpilot E600 Firmware
Versions up to, including, (<=) 4.3.2-r4
cpe:2.3:o:cambiumnetworks:cnpilot_e600_firmware:*:*:*:*:*:*:*:*
Matching versions
When used together with: Cambiumnetworks » Cnpilot E600 » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2017-5259

EPSS FAQ

2.74%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 89 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2017-5259

Cambium cnPilot r200/r201 Command Execution as 'root'

First seen: 2020-04-26

auxiliary/admin/http/cnpilot_r_cmd_exec

Cambium cnPilot r200/r201 device software versions 4.2.3-R4 to 4.3.3-R4, contain an undocumented, backdoor 'root' shell. This shell is accessible via a specific url, to any authenticated user. The module uses this shell to execute arbitrary system commands as

More information

CVSS scores for CVE-2017-5259

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.0	HIGH	AV:N/AC:L/Au:S/C:C/I:C/A:C	8.0	10.0	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2017-5259

CWE-319 Cleartext Transmission of Sensitive Information

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Assigned by: nvd@nist.gov (Primary)
CWE-489 Active Debug Code

The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.

Assigned by: cve@rapid7.con (Secondary)

References for CVE-2017-5259

https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/

R7-2017-25: Cambium ePMP and cnPilot Multiple Vulnerabilities
Third Party Advisory

CVEs referencing this url

Jump to