Exploitation Summary
EIP tracks 1 public exploit for CVE-2017-5260.
Includes Metasploit module auxiliary/scanner/http/cnpilot_r_web_login_loot.
AI-analyzed exploit summary This Metasploit module scans for Cambium cnPilot r200/r201 devices, attempts to authenticate using provided credentials, and dumps the device configuration. It exploits an access control vulnerability (CVE-2017-5260) where the 'user' account can access full device configuration.
Description
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account.
Exploits (1)
This Metasploit module scans for Cambium cnPilot r200/r201 devices, attempts to authenticate using provided credentials, and dumps the device configuration. It exploits an access control vulnerability (CVE-2017-5260) where the 'user' account can access full device configuration.
References (1)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H