CVE-2022-21141

moderate-risk
Published 2022-02-18

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functions and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.

Do I need to act?

-
0.71% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
10
CVSS 10.0/10 Critical
NETWORK / LOW complexity

Affected Products (5)

Mimosa Management Platform
C6X Firmware
C5X Firmware
C5C Firmware
A5X Firmware

Affected Vendors

Airspan

References (2)

Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02
Third Party Advisory https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02
47
/ 100
moderate-risk
Severity 33/34 · Critical
Exploitability 2/34 · Minimal
Exposure 12/34 · Low