CVE-2022-21196

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 does not perform proper authorization and authentication checks on multiple API routes. An attacker may gain access to these API routes and achieve remote code execution, create a denial-of-service condition, and obtain sensitive information.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-285 CWE-287

Affected software

Vendor	Product	Versions
Airspan Networks	MMP	>= unspecified, < v1.0.3
Airspan Networks	PTP C-series	>= unspecified, < v2.8.6.1
Airspan Networks	PTMP C-series and A5x	>= unspecified, < v2.5.4.1

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02Third Party Advisory, US Government Resource

Timeline

Published: Feb 18, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-211977.5Improper input validation for some Intel(R) PROSet/Wireless WiFi products may allow an unauthenticated user to potentially enable denial of CVE-2022-211986.4Time-of-check time-of-use race condition in the BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable CVE-2022-211995.9An information disclosure vulnerability exists due to the hardcoded TLS key of reolink RLC-410W v3.0.0.136_20121102. A specially-crafted man CVE-2022-21209.8OFFIS DCMTK's (All versions prior to 3.6.7) service class user (SCU) is vulnerable to relative path traversal, allowing an attacker to write CVE-2022-212018.8A stack-based buffer overflow vulnerability exists in the confers ucloud_add_node_new functionality of TCL LinkHub Mesh Wi-Fi MS1G_00_01.00_CVE-2022-212025.5The affected product is vulnerable to an out-of-bounds read, which may result in disclosure of sensitive information.CVE-2022-212037.8Improper permissions in the SafeNet Sentinel driver for Intel(R) Quartus(R) Prime Standard Edition before version 21.1 may allow an authenti CVE-2022-212047.8Improper permissions for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may allow an authenticated user to potentially enable esc CVE-2022-212057.5Improper restriction of XML external entity reference in DSP Builder Pro for Intel(R) Quartus(R) Prime Pro Edition before version 21.3 may a CVE-2022-212087.5The package node-opcua before 2.74.0 are vulnerable to Denial of Service (DoS) due to a missing limitation on the number of received chunks CVE-2022-212097.8The affected product is vulnerable to an out-of-bounds read while processing project files, which allows an attacker to craft a project file CVE-2022-21216.5OFFIS DCMTK's (All versions prior to 3.6.7) has a NULL pointer dereference vulnerability while processing DICOM files, which may result in a