A vulnerability has been found in Cambium cnPilot 4.3.2-R4 and classified as problematic. Affected by this vulnerability is an unknown code of the component SNMP. The manipulation as part of a Community String leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the SNMP read-only (RO) community string has access to sensitive information by OID reference.

The bug was discovered 12/19/2017. The weakness was disclosed 12/20/2017 (Website). It is possible to read the advisory at blog.rapid7.com. This vulnerability is known as CVE-2017-5262 since 01/09/2017. The exploitation appears to be easy. The attack needs to be initiated within the local network. A single authentication is needed for exploitation. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries 110939, 110940, 110941 and 110942 are pretty similar.

Productinfo

Vendor

• Cambium

Name

• cnPilot

Version

• 4.3.2-R4

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion