AirVelocity: Use of Inherently Dangerous Function
CVE-2022-36310 is a high-severity use of inherently dangerous function vulnerability in AirVelocity from Airspan, with a CVSS 3.1 base score of 8.8 out of 10. It can be exploited remotely over the network by an attacker with a low-privileged account, without any action from a user. The record lists version 15.18.00.2511 as the first without the flaw, so updating AirVelocity to that release or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 1.63% chance of exploitation within 30 days, higher than 77% of scored CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update AirVelocity to 15.18.00.2511 or a later version.
- Read the advisory on github.com for workarounds and exact fixed builds.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Airspan | AirVelocity | before 15.18.00.2511 | 15.18.00.2511 |
| Airspan | Airvelocity 1500 Firmware | 9.3.0.01249 through 15.18.00.2511 | Not stated |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- NetworkCan be exploited remotely over a network, including the internet.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- LowA basic user account is enough.
- User interaction
- NoneNo action by a victim is required.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Scored by NVD.
Official description
Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpeed models.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use of Inherently Dangerous Function
The product calls a function that can never be guaranteed to work safely, regardless of how it is used.
How developers prevent this class of flaw
- Identify a list of prohibited API functions and prohibit developers from using these functions, providing safer alternatives. In some cases, automatic code analysis tools or the compiler can be instructed to spot use of prohibited functions, such as the banned.h include file from Microsoft's SDL.
- Use grep or static analysis tools to spot usage of dangerous functions.
More Use of Inherently Dangerous Function vulnerabilities (CWE-242)
Timeline
- CVE record published.
- Record last changed materially (score, affected products, status or references).
References
Advisories
- github.com/metaredteam/external-disclosures/security/advisories/GHSA-whc6-2989-42xmExploit, Third Party Advisory
- helpdesk.airspan.com/browse/TRN3-1689Permissions Required
Other vulnerabilities in AirVelocity
- 8.8 High severity
- 8.8 High severity
- 9.1 Critical severity
Spotted an error? Tell us.