SB2017121913 - Information disclosure in Cambium Networks cnPilot

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2017121913

SB2017121913 - Information disclosure in Cambium Networks cnPilot

Published: December 19, 2017

Security Bulletin ID SB2017121913
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Information disclosure

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Path traversal (CVE-ID: CVE-2017-5261)

The vulnerability allows a remote authenticated attacker to obtain potentially sensitive information.

The vulnerability exists in the ping and traceroute functions of the web administrative console in Cambium Networks cnPilot due to insufficient sanitization of user-supplied input processed by the Readfile script when a ping or traceroute command is issued. A remote attacker can send a specially crafted request that submits directory traversal characters and gain access to sensitive information, such as the admin password of the device, which could result in a complete system compromise.


Remediation

Install update from vendor's website.

References