CVE-2017-5263
High
Description
Versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware lack CSRF controls that can mitigate the effects of CSRF attacks, which are most typically implemented as randomized per-session tokens associated with any web application function, especially destructive ones.
SeverityHigh
CVSS8.0
Exploit probability—
ProductCambiumnetworks Cnpilot R190v Firmware
PublishedDec 20, 2017
First seenDec 20, 2017
Weakness typeCWE-352Cross-site request forgery (CSRF)
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| cambiumnetworks cnpilot_r190v_firmware | v ≤ 4.3.2-r4 | — |
| cambiumnetworks cnpilot_e410_firmware | v ≤ 4.3.2-r4 | — |
| cambiumnetworks cnpilot_r190n_firmware | v ≤ 4.3.2-r4 | — |
| cambiumnetworks cnpilot_e400_firmware | v ≤ 4.3.2-r4 | — |
| cambiumnetworks cnpilot_e600_firmware | v ≤ 4.3.2-r4 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.