cvelist/2022/1xxx/CVE-2022-1357.json

{
    "CVE_data_meta": {
        "ASSIGNER": "ics-cert@hq.dhs.gov",
        "DATE_PUBLIC": "2022-05-12T16:26:00.000Z",
        "ID": "CVE-2022-1357",
        "STATE": "PUBLIC",
        "TITLE": "Cambium Networks cnMaestro OS Command Injection"
    },
    "affects": {
        "vendor": {
            "vendor_data": [
                {
                    "product": {
                        "product_data": [
                            {
                                "product_name": "cnMaestro",
                                "version": {
                                    "version_data": [
                                        {
                                            "version_affected": "<",
                                            "version_value": "3.0.3-r32"
                                        },
                                        {
                                            "version_affected": "<",
                                            "version_value": "2.4.2-r29"
                                        },
                                        {
                                            "version_affected": "<",
                                            "version_value": "3.0.0-r34"
                                        }
                                    ]
                                }
                            }
                        ]
                    },
                    "vendor_name": "Cambium Networks"
                }
            ]
        }
    },
    "credit": [
        {
            "lang": "eng",
            "value": "Noam Moshe of Claroty reported these vulnerabilities to CISA."
        }
    ],
    "data_format": "MITRE",
    "data_type": "CVE",
    "data_version": "4.0",
    "description": {
        "description_data": [
            {
                "lang": "eng",
                "value": "The affected On-Premise cnMaestro allows an unauthenticated attacker to access the cnMaestro server and execute arbitrary code in the privileges of the web server. This lack of validation could allow an attacker to append arbitrary data to the logger command."
            }
        ]
    },
    "generator": {
        "engine": "Vulnogram 0.0.9"
    },
    "impact": {
        "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
        }
    },
    "problemtype": {
        "problemtype_data": [
            {
                "description": [
                    {
                        "lang": "eng",
                        "value": "CWE-78 OS Command Injection"
                    }
                ]
            }
        ]
    },
    "references": {
        "reference_data": [
            {
                "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04",
                "refsource": "CONFIRM",
                "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04"
            }
        ]
    },
    "solution": [
        {
            "lang": "eng",
            "value": "Cambium Networks recommends affected users apply one of the following upgrade packages:\n\n3.0.3-r32\n2.4.2-r29\n3.0.0-r34\nThe security patches are available from Cambium Networks support (login required).\n\nFor users of cnMaestro Cloud, these vulnerabilities have been patched by Cambium Networks and no further action is required."
        }
    ],
    "source": {
        "discovery": "UNKNOWN"
    }
}