CVE-2022-36309

Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

24.07% chance of exploitation in the next 30 days, 98th percentile

Published

2022-08-16

Updated

2024-08-03

Proof-of-concept exploits (1)

• metaredteam/external-disclosures/security/advisories/GHSA-p295-2jh6-g6g4

References

• CVE Record
• NVD entry

Related

• CVE-2022-24949
• CVE-2022-24950
• CVE-2022-24951
• CVE-2022-24952
• CVE-2022-36306
• CVE-2022-36310