{"containers": {"cna": {"affected": [{"product": "MMP", "vendor": "Airspan Networks", "versions": [{"lessThan": "v1.0.3", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "PTP C-series", "vendor": "Airspan Networks", "versions": [{"lessThan": "v2.8.6.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}, {"product": "PTMP C-series and A5x", "vendor": "Airspan Networks", "versions": [{"lessThan": "v2.5.4.1", "status": "affected", "version": "unspecified", "versionType": "custom"}]}], "credits": [{"lang": "en", "value": "Noam Moshe of Claroty reported these vulnerabilities to CISA."}], "datePublic": "2022-02-03T00:00:00", "descriptions": [{"lang": "en", "value": "MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-327", "description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-02-18T17:50:18", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02"}], "solutions": [{"lang": "en", "value": "Airspan Networks recommends users update to following products (Login Required):\n\nMMP: Version 1.0.4 or later\nPTP:\nC5x: Version 2.90 or later\nC5c: Version 2.90 or later\nPTMP: \nC-series: Version 2.9.0 or later\nA5x: Version 2.9.0 or later"}], "source": {"advisory": "ICSA-22-034-02", "discovery": "UNKNOWN"}, "title": "Airspan Networks Mimosa Use of a Broken or Risky Cryptographic Algorithm", "x_generator": {"engine": "Vulnogram 0.0.9"}, "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "2022-02-03T17:50:00.000Z", "ID": "CVE-2022-21800", "STATE": "PUBLIC", "TITLE": "Airspan Networks Mimosa Use of a Broken or Risky Cryptographic Algorithm"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "MMP", "version": {"version_data": [{"version_affected": "<", "version_value": "v1.0.3"}]}}, {"product_name": "PTP C-series", "version": {"version_data": [{"version_affected": "<", "version_value": "v2.8.6.1"}]}}, {"product_name": "PTMP C-series and A5x", "version": {"version_data": [{"version_affected": "<", "version_value": "v2.5.4.1"}]}}]}, "vendor_name": "Airspan Networks"}]}}, "credit": [{"lang": "eng", "value": "Noam Moshe of Claroty reported these vulnerabilities to CISA."}], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords."}]}, "generator": {"engine": "Vulnogram 0.0.9"}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02"}]}, "solution": [{"lang": "en", "value": "Airspan Networks recommends users update to following products (Login Required):\n\nMMP: Version 1.0.4 or later\nPTP:\nC5x: Version 2.90 or later\nC5c: Version 2.90 or later\nPTMP: \nC-series: Version 2.9.0 or later\nA5x: Version 2.9.0 or later"}], "source": {"advisory": "ICSA-22-034-02", "discovery": "UNKNOWN"}}}}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-21800", "datePublished": "2022-02-03T00:00:00", "dateReserved": "2021-12-21T00:00:00", "dateUpdated": "2022-02-18T17:50:18", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:airspan:mimosa_management_platform:*:*:*:*:*:*:*:*", "matchCriteriaId": "064DE49C-CD3C-43AF-864E-D8373EAD9B52", "versionEndExcluding": "1.0.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:airspan:c6x_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4650A7AA-DD66-4A8B-BB37-4D6789D60B85", "versionEndExcluding": "2.8.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:airspan:c6x:-:*:*:*:*:*:*:*", "matchCriteriaId": "080058F5-00C3-4204-8942-18D5347614B2", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:airspan:c5x_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "2C295D0C-2C21-474D-B38F-0EA15FB59113", "versionEndExcluding": "2.8.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:airspan:c5x:-:*:*:*:*:*:*:*", "matchCriteriaId": "2C3239C7-ADFF-413E-86CD-EDBD86FB1ACB", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:airspan:c5c_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "31B5039E-8D62-4EB8-A264-1DBA97CC7289", "versionEndExcluding": "2.8.6.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:airspan:c5c:-:*:*:*:*:*:*:*", "matchCriteriaId": "9944E65E-56D0-4010-B27B-FD7FE469EC20", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:airspan:a5x_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "ECA42797-2BBB-4622-9F57-2BE53E3D8019", "versionEndExcluding": "2.5.4.1", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:airspan:a5x:-:*:*:*:*:*:*:*", "matchCriteriaId": "C1009C19-795D-4F1A-8C82-A22754E0EBC4", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords."}, {"lang": "es", "value": "MMP: Todas las versiones anteriores a v1.0.3, PTP C-series: Versiones de dispositivos anteriores a v2.8.6.1, y PTMP C-series y A5x: Versiones de dispositivos anteriores a v2.5.4.1, usan el algoritmo MD5 para hacer un hash de las contrase\u00f1as antes de almacenarlas, pero no ponen salt al hash. Como resultado, los atacantes pueden ser capaces de descifrar las contrase\u00f1as con hash"}], "id": "CVE-2022-21800", "lastModified": "2023-07-24T13:50:23.057", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}, "published": "2022-02-18T18:15:12.800", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-327"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}

{}