Cambium ePMP up to 3.5 Web Management Console get_chart POST Request command injection

Summaryinfo

A vulnerability was found in Cambium ePMP up to 3.5 and classified as critical. Impacted is the function get_chart of the component Web Management Console. The manipulation as part of POST Request results in command injection. This vulnerability is known as CVE-2017-5255. It is possible to launch the attack remotely. Furthermore, an exploit is available.

Detailsinfo

A vulnerability was found in Cambium ePMP up to 3.5. It has been classified as critical. Affected is the function get_chart of the component Web Management Console. The manipulation as part of a POST Request leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root.

The bug was discovered 12/19/2017. The weakness was published 12/20/2017 (Website). The advisory is shared for download at blog.rapid7.com. This vulnerability is traded as CVE-2017-5255 since 01/09/2017. It is possible to launch the attack remotely. A authentication is needed for exploitation. Technical details and a public exploit are known. The MITRE ATT&CK project declares the attack technique as T1202.

The exploit is shared for download at exploit-db.com. It is declared as highly functional. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at Exploit-DB (43413). Similar entries are available at VDB-110939, VDB-110941, VDB-110942 and VDB-110943. Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Cambium

Name

• ePMP

Version

• 3.0
• 3.1
• 3.2
• 3.3
• 3.4
• 3.5

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion