A vulnerability, which was classified as problematic, has been found in Airspan AirVelocity 1500 up to 15.18.00.2511. This issue affects some unknown processing of the component Web Management. The manipulation with an unknown input leads to a exposure of information through directory listing vulnerability. Using CWE to declare the problem leads to CWE-548. A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers. Impacted is confidentiality. The summary by CVE is:

An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vulnerabilities were found in AirVelocity 1500 running software version 9.3.0.01249, were still present in 15.18.00.2511, and may affect other AirVelocity and AirSpeed models.

The weakness was released 08/16/2022 as GHSA-9v93-3qpc-hxj9. It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2022-36306 since 07/19/2022. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1083 according to MITRE ATT&CK.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-76638, VDB-91791, VDB-149618 and VDB-157204.

Productinfo

Vendor

• Airspan

Name

• AirVelocity 1500

Version

• 15.18.00.2511

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion