CVE-2017-5259

HIGH EXPLOITED IN THE WILD

Cambium Networks cnPilot <4.3.2-R4 - Privilege Escalation

Title source: llm

Exploitation Summary

CVE-2017-5259 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit, including a Metasploit module auxiliary/admin/http/cnpilot_r_cmd_exec.

AI-analyzed exploit summary This Metasploit module exploits an undocumented backdoor root shell in Cambium cnPilot r200/r201 devices (versions 4.2.3-R4 to 4.3.3-R4) to execute arbitrary commands as root via authenticated HTTP requests.

Description

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.

Exploits (1)

metasploit WORKING POC

rubypoc

https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/cnpilot_r_cmd_exec.rb

View Code ZIP pw:eip

This Metasploit module exploits an undocumented backdoor root shell in Cambium cnPilot r200/r201 devices (versions 4.2.3-R4 to 4.3.3-R4) to execute arbitrary commands as root via authenticated HTTP requests.

Classification

Working Poc 100%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Cambium cnPilot r200/r201 (versions 4.2.3-R4 to 4.3.3-R4)

Auth required

Prerequisites: Authenticated access to the device · Target device running vulnerable firmware version

MITRE ATT&CK

T1078 - Valid Accounts T1210 - Exploitation of Remote Services

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Core References

Third Party Advisory x_refsource_misc

https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/

Scores

CVSS v3 8.8

EPSS 0.6634

EPSS Percentile 98.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2024-01-03

InTheWild.io 2024-05-29

CWE

CWE-319 CWE-489

Status published

Products (6)

Cambium Networks/cnPilot 4.3.2-R4 and prior

cambiumnetworks/cnpilot_e400_firmware < 4.3.2-r4

cambiumnetworks/cnpilot_e410_firmware < 4.3.2-r4

cambiumnetworks/cnpilot_e600_firmware < 4.3.2-r4

cambiumnetworks/cnpilot_r190n_firmware < 4.3.2-r4

cambiumnetworks/cnpilot_r190v_firmware < 4.3.2-r4

Published Dec 20, 2017

Tracked Since Feb 18, 2026