CVE-2022-36306

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

An authenticated attacker can enumerate and download sensitive files, including the eNodeB's web management UI's TLS private key, the web server binary, and the web server configuration file. These vulnerabilities were found in AirVelocity 1500 running software version 9.3.0.01249, were still present in 15.18.00.2511, and may affect other AirVelocity and AirSpeed models.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-219 CWE-552

Affected software

No affected versions have been published.

Timeline

Published: Aug 16, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-363076.8The AirVelocity 1500 prints SNMP credentials on its physically accessible serial port during boot. This was fixed in AirVelocity 1500 softwa CVE-2022-363089.1Airspan AirVelocity 1500 web management UI displays SNMP credentials in plaintext on software versions older than 15.18.00.2511, and stores CVE-2022-363098.8Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of CVE-2022-36314.8The OAuth Client by DigitialPixies WordPress plugin through 1.1.0 does not sanitize and escapes some of its settings, which could allow high CVE-2022-363108.8Airspan AirVelocity 1500 software prior to version 15.18.00.2511 had NET-SNMP-EXTEND-MIB enabled on its snmpd service, enabling an attacker CVE-2022-363116.1Airspan AirVelocity 1500 prior to software version 15.18.00.2511 is vulnerable to injection leading to XSS in the SNMP community field in th CVE-2022-363128.8Airspan AirVelocity 1500 software version 15.18.00.2511 lacks CSRF protections in the eNodeB's web management UI. This issue may affect othe CVE-2022-363135.5An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js. A malformed MKV file could cause the file CVE-2022-363145.5When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requ CVE-2022-363154.3When loading a script with Subresource Integrity, attackers with an injection capability could trigger the reuse of previously cached entrie CVE-2022-363166.1When using the Performance API, an attacker was able to notice subtle differences between PerformanceEntries and thus learn whether the targ CVE-2022-363176.5When visiting a website with an overly long URL, the user interface would start to hang. Due to session restore, this could lead to a perman