CVE-2017-5258

CVE-2017-5258 describes a cross-site scripting (XSS) vulnerability in Cambium Networks ePMP firmware versions 3.5 and prior, affecting ePMP 1000 and 2000 series devices. An authenticated attacker, knowing or guessing the SNMP read-write community string, can inject XSS strings into configuration files via SNMP. This allows the attacker to serve a malicious configuration file, which the device will then restore, executing the XSS. The vulnerability has a CVSS score of 5.4 (Medium), indicating a network-based attack with low privileges and complexity, requiring user interaction, and potentially impacting confidentiality and integrity. Despite this, its EPSS score is very low, suggesting a minimal likelihood of exploitation. Currently, there is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. The CVE has also received no community discussion or media coverage, further indicating a low level of attention and perceived threat.