Epmp 1000 Firmware
CVE-2017-7922
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L
Lifecycle Timeline
1DescriptionCVE.org
An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which may allow an attacker to gain access to sensitive information and possibly allow for configuration changes.
AnalysisAI
An Improper Privilege Management issue was discovered in Cambium Networks ePMP. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 38.1%.
Technical ContextAI
This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. An Improper Privilege Management issue was discovered in Cambium Networks ePMP. The privileges for SNMP community strings are not properly restricted, which may allow an attacker to gain access to sensitive information and possibly allow for configuration changes. Affected products include: Cambium Networks Epmp 1000 Firmware, Cambium Networks Epmp Elevate Firmware, Cambium Networks Epmp 2000 Firmware, Cambium Networks Epmp 1000 Hotspot Firmware.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.
More in Epmp 1000 Firmware
View allIn version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web
In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the
An Improper Access Control issue was discovered in Cambium Networks ePMP. Rated medium severity (CVSS 6.8), this vulnera
In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows or can guess the RW community string c
In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Devic
In version 3.5 and prior of Cambium Networks ePMP firmware, an attacker who knows (or guesses) the SNMP read/write (RW)
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today