CVE-2022-36308 impacts Airspan AirVelocity 1500 and potentially other AirVelocity/AirSpeed models, exposing SNMP credentials in plaintext within the web management UI and storing SNMPv3 credentials unhashed on the filesystem in software versions older than 15.18.00.2511. This critical vulnerability (CVSS 9.1) allows unauthenticated remote attackers to manipulate the eNodeB over SNMP with high impact on confidentiality and integrity. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion, indicating awareness among security researchers.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 9.3.0.01249, <= 15.18.00.2511CPE matchmatch criteria | cpe:2.3:o:airspan:airvelocity_1500_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.