{"id":"CVE-2022-36267","aliases":["EUVD-2022-38985","GHSA-w4rx-v2mp-rhf4"],"status":"published","title":"In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command...","description":"In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.54128,"percentile":0.99016,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-77"],"published":"2022-08-08T14:34:15Z","modified":"2026-06-17T04:53:09Z","exploits":[{"source":"exploitdb","id":"EDB-51011","title":"Airspan AirSpot 5410 version 0.3.4.1 - Remote Code Execution (RCE)","type":"remote","platform":"linux","date":"2022-09-20","url":"https://www.exploit-db.com/exploits/51011"},{"source":"pocgithub","id":"0xNslabs/CVE-2022-36267-PoC","title":"0xNslabs/CVE-2022-36267-PoC","date":"2024-01-08","url":"https://github.com/0xNslabs/CVE-2022-36267-PoC"}],"products":[{"vendor":"airspan","product":"airspot_5410_firmware"}],"references":[{"url":"https://gist.github.com/Nwqda/e82b3155401b094372195fdaa9b54833","tags":["x_refsource_MISC","x_transferred","Exploit","Mitigation","Third Party Advisory"]},{"url":"https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf","tags":["x_refsource_MISC","x_transferred","Product","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/168047/AirSpot-5410-0.3.4.1-4-Remote-Command-Injection.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36267"},{"url":"https://github.com/advisories/GHSA-w4rx-v2mp-rhf4"}],"sources":{"cve":[{"id":"CVE-2022-36267","description":"In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.","status":"published","published":"2022-08-08T14:34:15Z","modified":"2024-08-03T10:00:04.316Z","updated_at":"2026-11-02T14:34:35.945659Z"}],"euvd":[{"id":"EUVD-2022-38985","description":"In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.","status":"published","published":"2022-08-08T14:34:15Z","modified":"2024-08-03T10:00:04Z","updated_at":"2026-11-03T03:25:26.362132Z"}],"ghsa":[{"id":"GHSA-w4rx-v2mp-rhf4","title":"In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command...","description":"In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.","status":"published","published":"2022-08-09T00:00:25Z","modified":"2023-02-01T05:02:33Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:49:56.778846Z"}],"nvd":[{"id":"CVE-2022-36267","description":"In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.","status":"published","published":"2022-08-08T15:15:09.083Z","modified":"2026-06-17T04:53:09.043Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"updated_at":"2026-11-02T14:07:24.39467Z"}]}}