CVE-2022-1360 - Vulnerability Details - OpenCVE

The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server configuration settings.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

AV:N/AC:L/Au:N/C:P/I:P/A:P

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Cambiumnetworks	Cnmaestro

Configuration 1 [-]

OR	cpe:2.3:o:cambiumnetworks:cnmaestro:2.4.2::::on_premises:::
	cpe:2.3:o:cambiumnetworks:cnmaestro:3.0.0::::on_premises:::
	cpe:2.3:o:cambiumnetworks:cnmaestro:3.0.3::::on_premises:::

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04

History

No history.

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-05-17T20:17:51.582137Z

Updated: 2024-09-17T03:33:52.285Z

Reserved: 2022-04-14T00:00:00

Link: CVE-2022-1360

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-05-17T21:15:08.097

Modified: 2024-11-21T06:40:34.273

Link: CVE-2022-1360

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "cnMaestro", "vendor": "Cambium Networks", "versions": [{"lessThan": "3.0.3-r32", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "2.4.2-r29", "status": "affected", "version": "unspecified", "versionType": "custom"}, {"lessThan": "3.0.0-r34", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Noam Moshe of Claroty reported these vulnerabilities to CISA."}], "datePublic": "2022-05-12T00:00:00", "descriptions": [{"lang": "en", "value": "The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server configuration settings."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-78", "description": "CWE-78 OS Command Injection", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-05-17T20:17:51", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04"}], "solutions": [{"lang": "en", "value": "Cambium Networks recommends affected users apply one of the following upgrade packages:\n\n3.0.3-r32\n2.4.2-r29\n3.0.0-r34\nThe security patches are available from Cambium Networks support (login required).\n\nFor users of cnMaestro Cloud, these vulnerabilities have been patched by Cambium Networks and no further action is required."}], "source": {"discovery": "UNKNOWN"}, "title": "Cambium Networks cnMaestro OS Command Injection", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2022-05-12T16:26:00.000Z", "ID": "CVE-2022-1360", "STATE": "PUBLIC", "TITLE": "Cambium Networks cnMaestro OS Command Injection"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "cnMaestro", "version": {"version_data": [{"version_affected": "<", "version_value": "3.0.3-r32"}, {"version_affected": "<", "version_value": "2.4.2-r29"}, {"version_affected": "<", "version_value": "3.0.0-r34"}]}}]}, "vendor_name": "Cambium Networks"}]}}, "credit": [{"lang": "eng", "value": "Noam Moshe of Claroty reported these vulnerabilities to CISA."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server configuration settings."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-78 OS Command Injection"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04", "refsource": "CONFIRM", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04"}]}, "solution": [{"lang": "en", "value": "Cambium Networks recommends affected users apply one of the following upgrade packages:\n\n3.0.3-r32\n2.4.2-r29\n3.0.0-r34\nThe security patches are available from Cambium Networks support (login required).\n\nFor users of cnMaestro Cloud, these vulnerabilities have been patched by Cambium Networks and no further action is required."}], "source": {"discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:03:05.877Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04"}]}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-1360", "datePublished": "2022-05-17T20:17:51.582137Z", "dateReserved": "2022-04-14T00:00:00", "dateUpdated": "2024-09-17T03:33:52.285Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:cambiumnetworks:cnmaestro:2.4.2:*:*:*:on_premises:*:*:*", "matchCriteriaId": "93FCE8FD-61FF-4160-9581-C8DD573F5BE0", "vulnerable": true}, {"criteria": "cpe:2.3:o:cambiumnetworks:cnmaestro:3.0.0:*:*:*:on_premises:*:*:*", "matchCriteriaId": "8E2A97A9-FD28-4592-AB4A-E02E007B6CE3", "vulnerable": true}, {"criteria": "cpe:2.3:o:cambiumnetworks:cnmaestro:3.0.3:*:*:*:on_premises:*:*:*", "matchCriteriaId": "105A9A7C-BC84-4332-B3A1-525947CFF0D2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server configuration settings."}, {"lang": "es", "value": "El cnMaestro On-Premise afectado es vulnerable a una ejecuci\u00f3n de c\u00f3digo en el servidor de alojamiento de cnMaestro. Esto podr\u00eda permitir a un atacante remoto cambiar los ajustes de configuraci\u00f3n del servidor"}], "id": "CVE-2022-1360", "lastModified": "2024-11-21T06:40:34.273", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.2, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 5.3, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-05-17T21:15:08.097", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-132-04"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-78"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}