CWE Code: 78
Vulnerability Type: privilege_escalation
CVSS Score: 9.0
CWE Name:  Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Summary: in version 3.5 and prior of cambium networks epmp firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted post request to the get_chart function and run os-level commands, effectively as root.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-12-20
Last Modified Date: 2019-10-09