CVE-2022-0138: Airspan Networks Mimosa Deserialization of Untrusted Data

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-18 · updated 2026-06-17
Weakness: CWE-502

Description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created.

Affected products

Airspan A5X Firmware: before 2.5.4.1 — fixed in 2.5.4.1
Airspan C5C Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C5X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C6X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan Mimosa Management Platform: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: Airspan A5X Firmware 2.5.4.1; Airspan C5C Firmware 2.8.6.1; Airspan C5X Firmware 2.8.6.1; Airspan C6X Firmware 2.8.6.1; Airspan Mimosa Management Platform 1.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-0138 or the next vulnerability affects your stack