CVE-2022-36306 Information disclosure in AirVelocity
An authenticated attacker can enumerate and download sensitive files, including TLS private keys and configuration files, from Airspan AirVelocity devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-36306?
CVE-2022-36306 is a medium-severity vulnerability in Airspan AirVelocity, published on 16 Aug 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vulnerabilities were found in AirVelocity 1500 running software version 9.3.0.01249, were still present in 15.18.00.2511, and may affect other AirVelocity and AirSpeed models.
Which versions are affected by CVE-2022-36306?
It affects 1 product.
Products include Airspan Airvelocity 1500 Firmware.
How do I fix CVE-2022-36306?
No fix has been published for CVE-2022-36306 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-36306 being exploited?
There is no known exploitation of CVE-2022-36306 in the wild and no public exploit code.