CVE-2022-36309

Deeper analysis

Airspan AirVelocity 1500 devices running software versions prior to 15.18.00.2511 contain a command injection vulnerability tracked as CVE-2022-36309. The flaw exists in the ActiveBank parameter of the recoverySubmit.cgi script exposed by the eNodeB web management interface and is classified under CWE-78. The same issue may affect additional AirVelocity and AirSpeed models. A CVSS 3.1 base score of 8.8 reflects network attack vector, low attack complexity, and low privileges required.

An authenticated user with access to the web UI can supply a malicious ActiveBank value that results in arbitrary command execution as root. Successful exploitation grants full control over the affected eNodeB, enabling confidentiality, integrity, and availability impacts on the radio access network element.

Vendor advisories direct customers to upgrade to version 15.18.00.2511; the corresponding Airspan and GitHub security notices are published at the referenced URLs. The associated EPSS score reached a peak of 0.2223 but shows no material post-disclosure climb that would indicate emerging exploitation interest.