AirVelocity: Insufficiently Protected Credentials
CVE-2022-36308 is a critical-severity insufficiently protected credentials vulnerability in AirVelocity from Airspan, with a CVSS 3.1 base score of 9.1 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists version 15.18.00.2511 as the first without the flaw, so updating AirVelocity to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.77% chance of exploitation within 30 days, higher than 56% of scored CVEs.
Critical severity: a successful attack would have severe impact.
What to do
- Update AirVelocity to 15.18.00.2511 or a later version.
- Read the advisory on github.com for workarounds and exact fixed builds.
- Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Airspan | AirVelocity | before 15.18.00.2511 | 15.18.00.2511 |
| Airspan | Airvelocity 1500 Firmware | 9.3.0.01249 through 15.18.00.2511 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- NoneAvailability is not affected.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Scored by NVD.
Official description
Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may affect other AirVelocity and AirSpeed models.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
How developers prevent this class of flaw
- Use an appropriate security mechanism to protect the credentials.
- Make appropriate use of cryptography to protect the credentials.
- Use industry standards to protect the credentials (e.g. LDAP, keystore, etc.).
More Insufficiently Protected Credentials vulnerabilities (CWE-522)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Advisories
- github.com/metaredteam/external-disclosures/security/advisories/GHSA-qjgc-rx8m-q58xThird Party Advisory
- helpdesk.airspan.com/browse/TRN3-1692Permissions Required
Other vulnerabilities in AirVelocity
- 8.8 High severity
- 8.8 High severity
- 8.8 High severity
Recent Insufficiently Protected Credentials vulnerabilities
- 7.5 High severity
- 9.8 Critical severity
- 9.8 Critical severity
- 9.1 Critical severity
- 7.5 High severity
- 7.8 High severity
Spotted an error? Tell us.