CVE-2022-36266 - CVE House
Back to Database
Status published Medium CVE-2022-36266

In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists...

Vulnerability Description

In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a stored XSS vulnerability. As the binary file /home/www/cgi-bin/login.cgi does not check if the user is authenticated, a malicious actor can craft a specific request on the login.cgi endpoint that contains a base32 encoded XSS payload that will be accepted and stored. A successful attack will results in the injection of malicious scripts into the user settings page.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-36266

Credits & Attribution

No credits recorded in the NVD database.

References

More from airspan

View All →
CVE-2022-36267
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists...
Critical 9.8
CVE-2022-36265
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists...
High 7.2
CVE-2022-36264
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists...
Critical 9.1
CVE-2008-1543
The Advanced User Interface Pages in the ProST Web Management...
High 7.5
CVE-2008-1542
Airspan Base Station Distribution Unit (BSDU) has "topsecret" as its...
High 7.5

Affected Vendor

Affected Software

airspot 5410 firmware
Vulnerable Versions:
0

Timeline

Official Publish: August 8th, 2022
Last Modified: August 3rd, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.