Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. The ping functionality can be called without user authentication when crafting a malicious http request by injecting code in one of the parameters allowing for remote code execution. This vulnerability is exploited via the binary file /home/www/cgi-bin/diagnostics.cgi that accepts unauthenticated requests and unsanitized data. As a result, a malicious actor can craft a specific request and interact remotely with the device.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
🔴 AVideo, CSRF Profile Photo Overwrite, #CVE-2022-36267 (Critical) https://dailycve.com/avideo-csrf-profile-photo-overwrite-cve-2022-36267-critical/
Post summary
The post announces a critical CSRF profile‑photo overwrite vulnerability in AVideo (CVE‑2022‑36267) but provides no exploit details, patches, or evidence of live attacks.
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| HW | airspan | airspot_5410 | - | - | - |
| OS | airspan | airspot_5410_firmware | - | - | - |