Airspan Networks vulnerabilities
We track 6 vulnerabilities in Airspan Networks products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on February 18, 2022.
Latest Airspan Networks vulnerabilities
- 9.8 Critical severity
MMP: Server-Side Request Forgery
This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker coul
- 9.8 Critical severity
MMP: Improper Authentication
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access
- 7.5 High severity
MMP: Improper Neutralization of Special Elements used in an SQL Command
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input, which may allow an attacker to perform a SQL injection and obtain sensitive
- 9.8 Critical severity
MMP: Improper Neutralization of Special Elements used in an OS Command
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input on several locations, which may allow an attacker to inject arbitrary command
- 9.8 Critical severity
MMP: Incorrect Authorization
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functi
- 7.5 High severity
MMP: Deserialization of Untrusted Data
MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created.