In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console…

published 2017-12-20 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-14360

cvss: 8.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 74.2%; EPSS 74.2% chance of exploitation in 30 days, percentile 99.4%
public exploits: 5; Metasploit, Exploit-DB

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows any authenticated user (including the otherwise low-privilege readonly user) to inject shell meta-characters as part of a specially-crafted POST request to the get_chart function and run OS-level commands, effectively as root.

Timeline

2015-11-28 First public exploit (Metasploit exploit/unix/http/epmp1000_ping_cmd_shell)
2017-12-20 Published

Exploit prediction

74.23% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/unix/http/epmp1000_get_chart_cmd_shell Cambium ePMP1000 'get_chart' Shell via Command Injection (v3.1-3.5-RC7) metasploit exploit, excellent rank, 2017-12-18
Metasploit exploit/unix/http/epmp1000_ping_cmd_shell Cambium ePMP1000 'ping' Shell via Command Injection (up to v2.5) metasploit exploit, excellent rank, 2015-11-28
Metasploit auxiliary/scanner/http/epmp1000_get_chart_cmd_exec Cambium ePMP 1000 'get_chart' Command Injection (v3.1-3.5-RC7) metasploit auxiliary, normal rank
Metasploit auxiliary/scanner/http/epmp1000_ping_cmd_exec Cambium ePMP 1000 'ping' Command Injection (up to v2.5) metasploit auxiliary, normal rank
EDB-43413 Cambium ePMP1000 - 'get_chart' Shell via Command Injection (Metasploit) remote, 2018-01-01

CVSS scores

assigned by	version	score	vector
NVD	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

Cambium Networks ePMP

Classification

Weakness

CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

exploit-db.com /exploits/43413/
exploit, third-party-advisory, vdb-entry
blog.rapid7.com /2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
third-party-advisory

Sources

CVE List CVE-2017-5255
NVD CVE-2017-5255

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary