CVE-2022-21800: Airspan Networks Mimosa Use of a Broken or Risky Cryptographic Algorithm

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-02-18 · updated 2026-06-17
Weakness: CWE-327

Description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords.

Affected products

Airspan A5X Firmware: before 2.5.4.1 — fixed in 2.5.4.1
Airspan C5C Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C5X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan C6X Firmware: before 2.8.6.1 — fixed in 2.8.6.1
Airspan Mimosa Management Platform: before 1.0.3 — fixed in 1.0.3

How to fix

Upgrade to a fixed version: Airspan A5X Firmware 2.5.4.1; Airspan C5C Firmware 2.8.6.1; Airspan C5X Firmware 2.8.6.1; Airspan C6X Firmware 2.8.6.1; Airspan Mimosa Management Platform 1.0.3. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-21800 or the next vulnerability affects your stack