{"id":45142,"date":"2022-02-04T10:05:06","date_gmt":"2022-02-04T10:05:06","guid":{"rendered":"http:\/\/7c953432-72cb-4342-8f09-f4834983a763"},"modified":"2022-02-04T10:05:06","modified_gmt":"2022-02-04T10:05:06","slug":"cisa-issues-advisory-warning-of-critical-vulnerabilities-in-airspan-networks-mimosa","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/cisa-issues-advisory-warning-of-critical-vulnerabilities-in-airspan-networks-mimosa\/","title":{"rendered":"CISA issues advisory warning of critical vulnerabilities in Airspan Networks Mimosa"},"content":{"rendered":"
<\/div>\n

CISA has warned of critical vulnerabilities in Airspan Networks Mimosa, some of which have earned CVSS severity score ratings of 10, the highest possible. <\/p>\n

When security vulnerabilities are severe and the products they impact are popular or critical to the operations of key industries, the US Cybersecurity and Infrastructure Security Agency (CISA) will often issue advisories to make sure they reach the attention of IT administrators and security staff. <\/p>\n

On Thursday, CISA issued such an advisory<\/a> for Airspan Networks Mimosa. Mimosa<\/a> devices are offered to industrial and enterprise players for point-to-multipoint (PTMP) network deployment. <\/p>\n

Seven vulnerabilities have been included in the advisory, detailing bugs earning themselves CVSS v3 base scores ranging from 6.5 to 10.0. <\/p>\n

The Airspan Networks products impacted by the vulnerabilities are the Mimosa Management Platform (MMP) prior to v1.0.3; PTP C-series devices running firmware prior to v2.8.6.1, and both PTMP C-series and A5x devices running firmware below v2.5.4.1. <\/p>\n

Noam Moshe, of Claroty, reported the security issues, which are said to be exploitable remotely and with low attack complexity.  <\/p>\n

“Successful exploitation of these vulnerabilities could allow an attacker to gain user data (including organization details) and other sensitive data, compromise Mimosa’s AWS cloud EC2 instance and S3 buckets, and execute unauthorized remote code on all cloud-connected Mimosa devices,” CISA says. <\/p>\n

<\/section>\n

The vulnerabilities are below: <\/p>\n