title: Cambium Networks cnMaestro SQL Injection
description: The affected On-Premise cnMaestro is vulnerable to a pre-auth data exfiltration through improper neutralization of special elements used in an SQL command. This could allow an attacker to exfiltrate data about other user’s accounts and devices.
problem types: CWE-89 SQL Injection
affected:
{
product: cnMaestro
vendor: Cambium Networks
versions:
lessThan: 3.0.3-r32, status: affected, version: unspecified, versionType: custom
lessThan: 2.4.2-r29, status: affected, version: unspecified, versionType: custom
lessThan: 3.0.0-r34, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_1: [
attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 7.4
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
version: 3.1
]
solutions: Cambium Networks recommends affected users apply one of the following upgrade packages:
3.0.3-r32
2.4.2-r29
3.0.0-r34
The security patches are available from Cambium Networks support (login required).
For users of cnMaestro Cloud, these vulnerabilities have been patched by Cambium Networks and no further action is required.