CVE-2022-36267

CVSS 3.1: 9.8 critical
EPSS: 54%p99
Published: Aug 8, 2022 · Aug 8, 2022
Modified: Jun 17, 2026

Analyze CVE-2022-36267 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.

Vendors: airspan

Products: airspot 5410 firmware

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (54.1%)

In the news

2 stories

Mirai V3G4 botnet exploits 13 flaws to target IoT devices

Security AffairsFeb 16, 21:32 UTC · Feb 16, 2023MalwareCVE-2012-4869 CVE-2014-9727 CVE-2017-5173+62 · 1 read

Mirai Variant V3G4 Targets IoT Devices

Unit 42 tracked the Mirai variant V3G4 exploiting 13 vulnerabilities across IoT devices and servers from July-December 2022 to build a DDoS botnet.

Palo Alto Unit 42Aug 17, 13:05 UTC · Aug 17, 2026MalwareExploitedCVE-2012-4869 CVE-2014-9727 CVE-2017-5173+63 · 2 reads