CVE-2008-1262
The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication credentials, which allows remote attackers to (1) upload malformed firmware or (2) bind the antenna to a different WiMAX base station…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (8.53%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The administration panel on the Airspan WiMax ProST 4.1 antenna with 6.5.38.0 software does not verify authentication credentials, which allows remote attackers to (1) upload malformed firmware or (2) bind the antenna to a different WiMAX base station via unspecified requests to forms under process_adv/.
- CVSS 2.0
- 10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 8.53% probability · 95th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- airspan/wimax prost
- Source
- cve@mitre.org
References
- http://airspan4wimax.googlepages.com/Exploit
- http://secunia.com/advisories/29265Vendor Advisory
- http://www.0x000000.com/?i=524
- http://www.gnucitizen.org/projects/router-hacking-challenge/Exploit
- http://www.kb.cert.org/vuls/id/248372US Government Resource
- http://www.securityfocus.com/archive/1/489009/100/0/threaded
- http://www.securityfocus.com/bid/28122Exploit
- http://www.sharemethods.net/nepal/servlet/open?keeppath=false&aid=29820
- http://www.vupen.com/english/advisories/2008/0802/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41052
- http://airspan4wimax.googlepages.com/Exploit
- http://secunia.com/advisories/29265Vendor Advisory
- http://www.0x000000.com/?i=524
- http://www.gnucitizen.org/projects/router-hacking-challenge/Exploit
- http://www.kb.cert.org/vuls/id/248372US Government Resource
- http://www.securityfocus.com/archive/1/489009/100/0/threaded
- http://www.securityfocus.com/bid/28122Exploit
- http://www.sharemethods.net/nepal/servlet/open?keeppath=false&aid=29820
- http://www.vupen.com/english/advisories/2008/0802/references
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41052
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.