Exploitation Summary
EIP tracks 5 public exploits for CVE-2017-5255.
PoCs published by Metasploit, including Metasploit module auxiliary/scanner/http/epmp1000_ping_cmd_exec.
AI-analyzed exploit summary This Metasploit module exploits an OS command injection vulnerability in Cambium ePMP1000 device management portal via the 'get_chart' endpoint. It authenticates using default credentials and injects a reverse shell payload.
Description
In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root.
Exploits (5)
This Metasploit module exploits an OS command injection vulnerability in Cambium ePMP1000 device management portal via the 'get_chart' endpoint. It authenticates using default credentials and injects a reverse shell payload.
This Metasploit module exploits a command injection vulnerability in Cambium ePMP 1000 devices (versions <2.5) via the 'ping' functionality. It authenticates using default credentials and injects arbitrary commands through the 'packets_num' parameter.
This Metasploit module exploits an OS command injection vulnerability in Cambium ePMP 1000 devices (versions 3.1-3.5-RC7) by injecting commands into the 'timestamp' parameter of the 'get_chart' endpoint. It requires authentication with default credentials.
This Metasploit module exploits a command injection vulnerability in Cambium ePMP1000 devices (up to v2.5) via the 'ping' functionality, allowing authenticated users to execute arbitrary commands and obtain a reverse shell.
This Metasploit module exploits a command injection vulnerability in Cambium ePMP1000 devices via the 'get_chart' endpoint, allowing authenticated users to execute arbitrary commands and obtain a reverse shell. It targets versions 3.1-3.5-RC7 and requires valid credentials.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H