title: Cambium Networks cnMaestro OS Command Injection
description: The affected On-Premise cnMaestro is vulnerable to execution of code on the cnMaestro hosting server. This could allow a remote attacker to change server configuration settings.
problem types: CWE-78 OS Command Injection
affected:
{
product: cnMaestro
vendor: Cambium Networks
versions:
lessThan: 3.0.3-r32, status: affected, version: unspecified, versionType: custom
lessThan: 2.4.2-r29, status: affected, version: unspecified, versionType: custom
lessThan: 3.0.0-r34, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: LOW
baseScore: 8.2
baseSeverity: HIGH
confidentialityImpact: LOW
integrityImpact: HIGH
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L
version: 3.1
]
solutions: Cambium Networks recommends affected users apply one of the following upgrade packages:
3.0.3-r32
2.4.2-r29
3.0.0-r34
The security patches are available from Cambium Networks support (login required).
For users of cnMaestro Cloud, these vulnerabilities have been patched by Cambium Networks and no further action is required.