CVE-2022-21196 Explained : Impact and Mitigation

Airspan Networks Mimosa Improper Authorization

Understanding CVE-2022-21196

This CVE impacts Airspan Networks' products, including MMP, PTP C-series, and PTMP C-series and A5x, due to improper authorization and authentication checks on multiple API routes.

What is CVE-2022-21196?

The vulnerability in MMP, PTP C-series, and PTMP C-series and A5x allows attackers to exploit API routes, leading to remote code execution, denial-of-service attacks, and access to sensitive information.

The Impact of CVE-2022-21196

With a CVSS base score of 10, this critical vulnerability has a high impact on the confidentiality, integrity, and availability of the affected systems.

Technical Details of CVE-2022-21196

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The affected versions of MMP, PTP C-series, and PTMP C-series and A5x lack proper authorization and authentication checks on API routes, enabling various malicious activities.

Affected Systems and Versions

MMP: Versions prior to v1.0.3
PTP C-series: Versions prior to v2.8.6.1
PTMP C-series and A5x: Versions prior to v2.5.4.1

Exploitation Mechanism

Attackers can leverage this vulnerability to gain unauthorized access to API routes, leading to severe consequences like remote code execution, denial-of-service, and data leakage.

Mitigation and Prevention

To secure the affected systems, users should take the following steps:

Immediate Steps to Take

Update MMP to version 1.0.4 or later
Update PTP C-series to C5x version 2.90 or later
Update PTP C-series to C5c version 2.90 or later
Update PTMP C-series to C-series version 2.9.0 or later
Update PTMP A5x to version 2.9.0 or later

Long-Term Security Practices

In addition to immediate patching, users are advised to implement robust security measures, conduct regular security audits, and stay informed about potential vulnerabilities.

Patching and Updates

Regularly check for software updates and security advisories from Airspan Networks to ensure the systems are protected from known vulnerabilities.