CVE-2017-5260 - CVE House
Back to Database
Status published High CVE-2017-5260

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware,...

Vulnerability Description

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-5260

Credits & Attribution

No credits recorded in the NVD database.

References

More from Cambium Networks

View All →
CVE-2022-1362
Cambium Networks cnMaestro OS Command Injection
Medium 5
CVE-2022-1361
Cambium Networks cnMaestro SQL Injection
High 7.4
CVE-2022-1360
Cambium Networks cnMaestro OS Command Injection
High 8.2
CVE-2022-1359
Cambium Networks cnMaestro Path Traversal
Medium 5.7
CVE-2022-1358
Cambium Networks cnMaestro SQL Injection
Medium 5.9

Affected Vendor

Cambium Networks

View all reports →

Affected Software

cnPilot
Vulnerable Versions:
4.3.2-R4 and prior

Timeline

Official Publish: December 20th, 2017
Last Modified: August 5th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-472

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.