EIP-2026-100767

PRE-CVE

Cambium ePMP 1000 - Multiple Vulnerabilities

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-100767. PoCs published by Karn Ganeshen.

AI-analyzed exploit summary This exploit demonstrates an OS command injection vulnerability in Cambium Networks ePMP 1000 devices, allowing authenticated users (including low-privileged 'installer' and 'home' users) to execute arbitrary system commands via the Ping and Traceroute functions. The PoC includes HTTP requests that inject commands to dump the /etc/passwd file.

Description

Cambium ePMP 1000 - Multiple Vulnerabilities

Exploits (1)

exploitdb WORKING POC
by Karn Ganeshen · textwebappscgi
https://www.exploit-db.com/exploits/38776

This exploit demonstrates an OS command injection vulnerability in Cambium Networks ePMP 1000 devices, allowing authenticated users (including low-privileged 'installer' and 'home' users) to execute arbitrary system commands via the Ping and Traceroute functions. The PoC includes HTTP requests that inject commands to dump the /etc/passwd file.

Classification
Working Poc 100%
Attack Type
Rce
Complexity
Trivial
Reliability
Reliable
Target: Cambium Networks ePMP 1000 < v2.5
Auth required
Prerequisites: Authenticated access as 'admin', 'installer', or 'home' user · Network access to the target device
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026