CVE-2022-21196 CRITICAL

CVE-2022-21196: Airspan Networks Mimosa Improper Authorization

Vendor Airspan Networks
Product MMP
Weakness CWE-285
Published February 18, 2022
Last update April 16, 2025

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.

Key dates

02Disclosure timeline

February 18, 2022 CVE published
April 16, 2025 Record updated