CWE Code: 732
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Incorrect Permission Assignment for Critical Resource
Summary: in versions 4.3.2-r4 and prior of cambium networks cnpilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (dro) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-12-20
Last Modified Date: 2019-10-09