CVE-2022-21143: Airspan Networks Mimosa OS Command Injection

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-18 · updated 2026-06-17
Weakness: CWE-78

Description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not properly sanitize user input on several locations, which may allow an attacker to inject arbitrary commands.

Affected products

Airspan A5X Firmware: before 2.5.4.1 — fixed in 2.5.4.1
Airspan C5C Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C5X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C6X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan Mimosa Management Platform: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: Airspan A5X Firmware 2.5.4.1; Airspan C5C Firmware 2.8.6.1; Airspan C5X Firmware 2.8.6.1; Airspan C6X Firmware 2.8.6.1; Airspan Mimosa Management Platform 1.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21143 or the next vulnerability affects your stack