CVE-2017-5254
High
Description
In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism.
SeverityHigh
CVSS8.8
Exploit probability—
ProductCambiumnetworks Epmp 1000 Firmware
PublishedDec 20, 2017
First seenDec 20, 2017
Weakness typeCWE-284Improper access control
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cambiumnetworks epmp_1000_firmware | v ≤ 3.5 | — |
| cambiumnetworks epmp_2000_firmware | v ≤ 3.5 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.