CVE-2022-36308

CVE-2022-36308

Vendor Airspan

Product AirVelocity

Weakness CWE-256

Published August 16, 2022

Last update August 3, 2024

View on NVD All CVEs

CVSS base score

—

What the vulnerability does

01Description

Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may affect other AirVelocity and AirSpeed models.

Key dates

02Disclosure timeline

August 16, 2022 CVE published

August 3, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2022-36308 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/256.html

Related vulnerabilities

01Description

02Disclosure timeline

03References

04Related CVE