CVE-2022-21141: Airspan Networks Mimosa Incorrect Authorization

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-18 · updated 2026-06-17
Weakness: CWE-863

Description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization checks on multiple API functions. An attacker may gain access to these functions and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.

Affected products

Airspan A5X Firmware: before 2.5.4.1 — fixed in 2.5.4.1
Airspan C5C Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C5X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C6X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan Mimosa Management Platform: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: Airspan A5X Firmware 2.5.4.1; Airspan C5C Firmware 2.8.6.1; Airspan C5X Firmware 2.8.6.1; Airspan C6X Firmware 2.8.6.1; Airspan Mimosa Management Platform 1.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21141 or the next vulnerability affects your stack