CVE-2017-5259 is a critical vulnerability affecting Cambium Networks cnPilot firmware versions 4.3.2-R4 and prior, specifically impacting models like the e400, e410, e600, and r190n. It involves an undocumented web shell accessible via a specific HTTP path, granting root-privilege administration. This vulnerability carries a high CVSS score of 8.8, indicating a severe risk due to its network-based attack vector, low complexity, and potential for complete compromise (confidentiality, integrity, and availability). While not listed on CISA's KEV catalog, a Metasploit module exists for exploitation, and it has garnered community discussion and media coverage, suggesting awareness among threat actors.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.3.2-r4CPE matchmatch criteria | cpe:2.3:o:cambiumnetworks:cnpilot_r190v_firmware:*:*:*:*:*:*:*:* | ||
<= 4.3.2-r4CPE matchmatch criteria | cpe:2.3:o:cambiumnetworks:cnpilot_e410_firmware:*:*:*:*:*:*:*:* | ||
<= 4.3.2-r4CPE matchmatch criteria | cpe:2.3:o:cambiumnetworks:cnpilot_r190n_firmware:*:*:*:*:*:*:*:* | ||
<= 4.3.2-r4CPE matchmatch criteria | cpe:2.3:o:cambiumnetworks:cnpilot_e400_firmware:*:*:*:*:*:*:*:* | ||
<= 4.3.2-r4CPE matchmatch criteria | cpe:2.3:o:cambiumnetworks:cnpilot_e600_firmware:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.