Loading vulnerability…
Undocumented root-privileged web shell in Cambium Networks cnPilot
CVE-2017-5259 affects Cambium Networks cnPilot firmware version 4.3.2-R4 and earlier. An undocumented administration web shell is exposed through the device's HTTP-based management interface and operates with root privileges, providing an operating-system command execution interface. The vulnerability has been associated with exploitation by multiple IoT botnets, including Mirai.TBOT, AIRASHI, Gayfemboy, AISURU, and Dysphoria.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Access to the undocumented web shell provides root-privileged command execution on an affected device, compromising its administrative control. Exploitation has been associated with botnet propagation and enrollment of vulnerable devices into malicious infrastructure.
If you can’t patch tonight, do this now.
As a compensating control, restrict network access to the device's web management interface to trusted administration hosts or a dedicated management network, and prevent direct exposure to untrusted networks. These restrictions reduce access to the shell but do not remove the underlying functionality.
Patch, then assume compromise.
Upgrade affected Cambium Networks cnPilot devices to a firmware release newer than 4.3.2-R4 that removes or secures the undocumented administrative interface, if such a vendor fix is available. If upgrade guidance from the vendor is available, apply it across all exposed devices and verify that the undocumented functionality is no longer reachable after patching.
1 exploit validated by Mallory's analysis.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.