CVE-2017-5260
Status: ModifiedHigh (8.8)—
In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Base score: 8.8
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 8.13%
- Percentile among all scored CVEs: 95
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (5)
CWEs
- CWE-472
- CWE-732
References
Raw JSON (NVD)
Show
{
"id": "CVE-2017-5260",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 9,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:S/C:C/I:C/A:C",
"authentication": "SINGLE",
"integrityImpact": "COMPLETE",
"accessComplexity": "LOW",
"availabilityImpact": "COMPLETE",
"confidentialityImpact": "COMPLETE"
},
"acInsufInfo": false,
"impactScore": 10,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
],
"cvssMetricV30": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 8.8,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
},
"impactScore": 5.9,
"exploitabilityScore": 2.8
}
]
},
"affected": [
{
"source": "cve@rapid7.com",
"affectedData": [
{
"vendor": "Cambium Networks",
"product": "cnPilot",
"versions": [
{
"status": "affected",
"version": "4.3.2-R4 and prior"
}
]
}
]
}
],
"published": "2017-12-20T22:29:00.557",
"references": [
{
"url": "https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/",
"tags": [
"Third Party Advisory"
],
"source": "cve@rapid7.com"
},
{
"url": "https://blog.rapid7.com/2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/",
"tags": [
"Third Party Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Secondary",
"source": "cve@rapid7.com",
"description": [
{
"lang": "en",
"value": "CWE-472"
}
]
},
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-732"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account."
},
{
"lang": "es",
"value": "En versiones de firmware 4.3 2-R4 y anteriores de Cambium Networks cnPilot, aunque la opción para acceder al archivo de configuración no está disponible en la consola de administración web normal para la cuenta \"user\", se puede acceder al archivo de configuración mediante DRO (referencia de objeto directa) en http:///goform/down_cfg_file por esta cuenta 'user' de privilegios bajos."
}
],
"lastModified": "2026-06-17T01:20:15.723",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_r190v_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "87AFE671-F9B3-4FCE-B659-BF3EB3623A94",
"versionEndIncluding": "4.3.2-r4"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_r190v:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "B7E6A303-C3EF-46EB-AE4B-C5236CA28B67"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_e410_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "02EB86EE-5DBE-4AFD-9A97-54064EF70B35",
"versionEndIncluding": "4.3.2-r4"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_e410:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "74E7C383-DCE9-4A3B-A410-7C35B9AB2366"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_r190n_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E4DDF69-A4C3-485E-9BB4-33C6322F5F18",
"versionEndIncluding": "4.3.2-r4"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_r190n:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "BC5D1CBD-0489-4F54-B4A4-EDD1B2FE8A4D"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_e400_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7C6997D-FFDB-4490-9DDD-A7DAACD9431E",
"versionEndIncluding": "4.3.2-r4"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_e400:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "FAFC8235-EF5B-4E8C-8FFD-A0A344C3DEBE"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:cambiumnetworks:cnpilot_e600_firmware:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C30EEBA-96E3-4382-9BE4-C5116EA66923",
"versionEndIncluding": "4.3.2-r4"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:h:cambiumnetworks:cnpilot_e600:-:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E4D0A961-FA16-4151-ABA5-5F401ACE27FE"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@rapid7.com"
}