CVE-2022-36309

8.8 highEPSS 25%

High (8.8) in airspan airvelocity 1500 firmware. EPSS 25% chance of exploitation in the next 30 days.

Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 25% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-78
Published: 2022-08-16
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

airspan:airvelocity_1500_firmware

References

https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-p295-2jh6-g6g4
https://helpdesk.airspan.com/browse/TRN3-1690
https://github.com/metaredteam/external-disclosures/security/advisories/GHSA-p295-2jh6-g6g4
https://helpdesk.airspan.com/browse/TRN3-1690

Check your stack JSON