Airspan vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2022-36312 Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI.High 8.8 · Aug 15, 2022
• CVE-2022-36310 Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker with SNMP write abilHigh 8.8 · Aug 15, 2022
• CVE-2022-36309 Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.High 8.8 · Aug 15, 2022
• CVE-2022-36308 Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials uCritical 9.1 · Aug 15, 2022
• CVE-2022-36267 In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability.Critical 9.8 · Aug 8, 2022
• CVE-2022-36265 In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Hidden system command web page.High 7.2 · Aug 8, 2022
• CVE-2022-36264 In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists an Unauthenticated remote Arbitrary File Upload vulnerability which allows overwriting arbitrarCritical 9.1 · Aug 8, 2022
• CVE-2022-21215 This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to tCritical 10 · Feb 18, 2022
• CVE-2022-21196 MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perforCritical 10 · Feb 18, 2022
• CVE-2022-21176 MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properHigh 8.6 · Feb 18, 2022
• CVE-2022-21143 MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properHigh 7.5 · Feb 18, 2022
• CVE-2022-21141 MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perforCritical 10 · Feb 18, 2022
• CVE-2022-0138 MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialiHigh 7.5 · Feb 18, 2022
• CVE-2008-1542 Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its password for the root account, which allows remote attackers to obtain administrative accesHigh 7.5 · Mar 28, 2008
• CVE-2008-1543 The Advanced User Interface Pages in the ProST Web Management component on the Airspan WiMAX ProST have a certain default User ID and password, which makes it eHigh 7.5 · Mar 28, 2008
• CVE-2008-1262 The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication credentials, which allows remote attackersHigh 10 · Mar 10, 2008