CVE-2022-36264 is an unauthenticated remote arbitrary file upload vulnerability affecting Airspan AirSpot 5410 devices running firmware version 0.3.4.1-4 and earlier. This critical vulnerability, with a CVSS score of 9.1, allows an attacker to overwrite any file on the system or upload new files by manipulating filenames with relative paths during the upload process. There is currently no public exploit code available (Metasploit, Nuclei, ExploitDB), and it is not listed on CISA's KEV catalog, indicating no active exploitation. Community discussion and media coverage are minimal.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 0.3.4.1-4CPE matchmatch criteria | cpe:2.3:o:airspan:airspot_5410_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.