CVE-2022-0138 - CVE House
Back to Database
Status published High CVE-2022-0138

Airspan Networks Mimosa Deserialization of Untrusted Data

Vulnerability Description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-0138

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Noam Moshe of Claroty reported these vulnerabilities to CISA.

References

More from Airspan Networks

View All →
CVE-2022-21800
Airspan Networks Mimosa Use of a Broken or Risky Cryptographic Algorithm
Medium 6.5
CVE-2022-21215
Airspan Networks Mimosa Server-Side Request Forgery (SSRF)
Critical 10
CVE-2022-21196
Airspan Networks Mimosa Improper Authorization
Critical 10
CVE-2022-21176
Airspan Networks Mimosa SQL Injection
High 8.6
CVE-2022-21143
Airspan Networks Mimosa OS Command Injection
High 7.5

Affected Vendor

Airspan Networks

View all reports →

Affected Software

MMP, PTP C-series, PTMP C-series and A5x
Vulnerable Versions:
unspecified

Timeline

Official Publish: February 18th, 2022
Last Modified: April 16th, 2025
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-502

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1068 Exploitation for Privilege Escalation
Privilege Escalation