CVE-2022-36267

What it actually does

CVE-2022-36267 is an unauthenticated remote command injection vulnerability in Airspan AirSpot 5410 firmware version 0.3.4.1-4 and earlier. The device exposes the diagnostics CGI endpoint at /home/www/cgi-bin/diagnostics.cgi, where ping functionality can be invoked without authentication. Because user-controlled request parameters are not safely sanitized before being passed to the underlying operating system command, an attacker can inject shell metacharacters or commands and achieve remote code execution on the appliance. With a CVSS score of 9.8 and network-accessible, low-complexity, no-authentication exploitation, successful compromise can provide full confidentiality, integrity, and availability impact on the affected device.

Why it matters to the business

Exploitation can allow an external attacker to take control of exposed Airspan AirSpot 5410 devices, disrupt wireless or access-network services, alter device configuration, capture sensitive traffic or credentials available to the device, and use the appliance as a foothold for broader network activity. The high EPSS score and public exploit availability indicate meaningful likelihood of opportunistic scanning and exploitation, especially for internet-accessible devices. Although this vulnerability is not currently listed in CISA KEV and is not specifically marked as ransomware-associated, command execution on network infrastructure can still create material operational risk, including outages, incident response costs, and downstream compromise.

How an attack unfolds

An attacker first identifies an exposed Airspan AirSpot 5410 management or web interface running affected firmware. They then send a crafted HTTP request directly to the unauthenticated diagnostics CGI endpoint used for ping tests. By placing command-injection syntax into an accepted ping-related parameter, the attacker causes diagnostics.cgi to execute unintended operating system commands instead of only performing the expected network diagnostic. After confirming command execution, the attacker may download tools, modify configuration, create persistence where possible, pivot to reachable internal services, intercept or manipulate traffic, or render the device unavailable. Because authentication is not required and exploitation is remotely reachable over the network, exposed devices are at elevated risk of automated exploitation.

How to fix it

Upgrade affected Airspan AirSpot 5410 firmware to a vendor-provided fixed release if available; the supplied vulnerability record does not list a specific fixed version, so administrators should consult Airspan advisories or support channels for the current secure firmware. Until a fixed firmware is deployed, remove internet exposure for AirSpot 5410 management interfaces, restrict access to trusted administrative networks or VPNs, and block unauthenticated access to /cgi-bin/diagnostics.cgi where feasible. Disable or limit diagnostic web functions if the platform supports it. Enforce network-layer ACLs, firewall rules, and management-plane isolation. Where patching is not possible, consider retiring or replacing affected devices, especially if reachable from untrusted networks. After remediation, rotate credentials and review device configuration because successful exploitation may have allowed arbitrary command execution.

How to confirm the fix worked

Confirm the deployed firmware version is newer than AirSpot 5410 version 0.3.4.1-4 or matches a vendor-confirmed fixed release. From an unauthenticated network position that should not have administrative access, verify that /cgi-bin/diagnostics.cgi and related ping diagnostics cannot be invoked or are restricted by authentication and network controls. Review firewall, reverse proxy, and management-plane ACLs to ensure the device is not reachable from the public internet or untrusted networks. Perform authenticated configuration review to confirm diagnostic features are disabled or constrained where possible. Conduct a controlled vulnerability scan using a non-destructive check for the diagnostics endpoint and affected firmware fingerprint; avoid sending command-executing payloads in production unless explicitly approved. Validate that logs no longer show unauthenticated diagnostic requests from untrusted sources.

Typical attack path

1. Scan for Airspan AirSpot 5410 web interfaces or exposed management services.
2. Fingerprint the device and firmware family using HTTP responses, page content, headers, or known endpoint behavior.
3. Send an unauthenticated crafted request to the diagnostics CGI endpoint used by the ping function.
4. Inject shell command syntax into an unsanitized request parameter processed by diagnostics.cgi.
5. Verify remote command execution through command output, timing behavior, outbound callback, or device-side artifacts.
6. Deploy follow-on commands such as configuration changes, credential collection, tool download, proxying, or service disruption.
7. Use the compromised device as a foothold for persistence, lateral movement, traffic interception, or denial-of-service activity.

How to detect it

To determine whether exploitation already occurred, review web server or embedded HTTP logs on the device, upstream reverse proxy logs, firewall logs, VPN logs, and network telemetry for requests to /cgi-bin/diagnostics.cgi from unauthenticated or untrusted sources. Pay particular attention to ping diagnostic requests containing shell metacharacters, URL-encoded command separators, command substitution syntax, or unexpected parameters. Correlate suspicious requests with device behavior such as new outbound connections, DNS lookups to unusual domains, downloads from external hosts, unexpected process execution, configuration changes, reboots, crashes, or service degradation. If device shell access or forensic acquisition is available, inspect web CGI access logs, system logs, command history, temporary directories, startup scripts, cron locations, and configuration backups for signs of unauthorized commands or persistence. Network defenders should also review outbound traffic from affected devices after suspicious diagnostic requests, especially HTTP, HTTPS, DNS, SSH, Telnet, or raw TCP connections to unfamiliar external IPs. Because public exploit code is available and the EPSS score is elevated, searches should cover the full period in which the device was exposed, not only recent days.

• /cgi-bin/diagnostics.cgi
• /home/www/cgi-bin/diagnostics.cgi
• diagnostics.cgi
• GET /cgi-bin/diagnostics.cgi
• POST /cgi-bin/diagnostics.cgi
• ping
• %3B
• %7C
• %26%26
• %60
• %24%28
• ;wget
• ;curl
• ;busybox
• ;nc
• ;telnet
• ;sh
• ;bash
• |wget
• |curl
• &&wget
• &&curl
• $(wget
• $(curl
• `wget
• `curl

What your security team should do

• Immediately inventory Airspan AirSpot 5410 devices and identify any running firmware version 0.3.4.1-4 or earlier.
• Prioritize remediation for any device with a management or web interface reachable from the internet, partner networks, guest networks, or other untrusted segments.
• Apply vendor-fixed firmware as soon as available; if no fixed firmware is available, isolate, replace, or retire affected devices.
• Block or tightly restrict access to /cgi-bin/diagnostics.cgi and other management CGI endpoints using firewalls, ACLs, VPN-only access, or management-plane segmentation.
• Search historical web, device, firewall, proxy, and NetFlow logs for unauthenticated requests to diagnostics.cgi, especially requests containing shell metacharacters or unexpected ping parameters.
• Inspect affected devices for unauthorized configuration changes, unfamiliar files, abnormal processes, unexpected outbound connections, and signs of reboot loops or service instability.
• Rotate administrative credentials and shared secrets associated with affected devices after containment, because command execution may have exposed local configuration or credentials.
• Create SIEM detections for suspicious requests to AirSpot diagnostic endpoints and prioritize alerts involving command separators, URL-encoded shell syntax, or outbound callbacks following diagnostic requests.
• Monitor threat intelligence and vendor advisories for confirmed fixed versions, exploit changes, or evidence of campaign-level exploitation.