CVE-2022-36308

CRITICAL

Airspan AirVelocity <15.18.00.2511 - Info Disclosure

Title source: llm
STIX 2.1

Description

Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores SNMPv3 credentials unhashed on the filesystem, enabling anyone with web access to use these credentials to manipulate the eNodeB over SNMP. This issue may affect other AirVelocity and AirSpeed models.

References (2)

Scores

CVSS v3 9.1
EPSS 0.0026
EPSS Percentile 49.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Details

CWE
CWE-522 CWE-256
Status published
Products (1)
airspan/airvelocity_1500_firmware 9.3.0.01249 - 15.18.00.2511
Published Aug 16, 2022
Tracked Since Feb 18, 2026