Vulnerability Details : CVE-2022-21196
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.
Vulnerability category: Execute codeBypassGain privilegeDenial of service
Products affected by CVE-2022-21196
- cpe:2.3:o:airspan:c6x_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:airspan:c5x_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:airspan:c5c_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:o:airspan:a5x_firmware:*:*:*:*:*:*:*:*
- cpe:2.3:a:airspan:mimosa_management_platform:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-21196
21.38%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 96 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-21196
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
10.0
|
HIGH | AV:N/AC:L/Au:N/C:C/I:C/A:C |
10.0
|
10.0
|
NIST | |
|
10.0
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
3.9
|
6.0
|
ICS-CERT | |
|
9.8
|
CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
3.9
|
5.9
|
NIST |
CWE ids for CVE-2022-21196
-
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.Assigned by: ics-cert@hq.dhs.gov (Secondary)
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
-
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-21196
-
https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02
Airspan Networks Mimosa | CISAThird Party Advisory;US Government Resource
Jump to