CVE-2022-36309

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 24.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-08-16 · updated 2026-06-17
Weakness: CWE-78

Description

Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.

Affected products

Airspan AirVelocity: from 9.3.0.01249 through 15.18.00.2511

References

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-p295-2jh6-g6g4
https://helpdesk.airspan.com/browse/TRN3-1690
https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-p295-2jh6-g6g4
https://helpdesk.airspan.com/browse/TRN3-1690

Get alerted when CVE-2022-36309 or the next vulnerability affects your stack