CVEvulnerability

CVE-2017-5256

5.4 MEDIUM Published 2017-12-20 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2017-12-20
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.4 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0 ([email protected])
3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
Weaknesses
CWE-79

Description

In version 3.5 and prior of Cambium Networks ePMP firmware, all authenticated users have the ability to update the Device Name and System Description fields in the web administration console, and those fields are vulnerable to persistent cross-site scripting (XSS) injection.

Affected configurations

• cambiumnetworks epmp 1000 firmware (<= 3.5) • cambiumnetworks epmp 2000 firmware (<= 3.5)

Related

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References