CVE-2022-21215: Airspan Networks Mimosa Server-Side Request Forgery (SSRF)

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-18 · updated 2026-06-17
Weakness: CWE-918

Description

This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc. Affecting MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1.

Affected products

Airspan A5X Firmware: before 2.5.4.1 — fixed in 2.5.4.1
Airspan C5C Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C5X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C6X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan Mimosa Management Platform: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: Airspan A5X Firmware 2.5.4.1; Airspan C5C Firmware 2.8.6.1; Airspan C5X Firmware 2.8.6.1; Airspan C6X Firmware 2.8.6.1; Airspan Mimosa Management Platform 1.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21215 or the next vulnerability affects your stack