Airvelocity 1500 Firmware vulnerabilities

4 known vulnerabilities in Airvelocity 1500 Firmware from Airspan. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  AirVelocity: Cross-Site Request Forgery

  CVE-2022-36312Aug 16, 2022Airspan

  Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.

• 8.8 High severity

  AirVelocity: Use of Inherently Dangerous Function

  CVE-2022-36310Aug 16, 2022AirspanEPSS 1.63%

  Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilities to execute commands as root on the eNodeB. This issue may affect other AirVelocity and AirSpee

• 8.8 High severity

  AirVelocity: Improper Neutralization of Special Elements used in an OS Command

  CVE-2022-36309Aug 16, 2022AirspanEPSS 25.2%

  Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. This issue may affect other AirVelocity and Ai

• 9.1 Critical severity

  AirVelocity: Insufficiently Protected Credentials

  CVE-2022-36308Aug 16, 2022Airspan

  Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate th