CVE-2017-7918 json
An Improper Access Control issue was discovered in Cambium Networks ePMP.
published 2017-06-21 9 y ago modified 2026-06-17 4 mo ago also EUVD-2017-16889
- cvss
- 6.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 6.7%
- EPSS 6.7% chance of exploitation in 30 days, percentile 93%
- public exploits
- 1
- Metasploit
Summary
An Improper Access Control issue was discovered in Cambium Networks ePMP. After a valid user has used SNMP configuration export, an attacker is able to remotely trigger device configuration backups using specific MIBs. These backups lack proper access control and may allow access to sensitive information and possibly allow for configuration changes.
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
cisa ICSA-17-166-01 updated cvss 6.8
Cambium Networks ePMP
-
Cambium Networks ePMPaffected: mitigation “Cambium recommends that users with the affected products should update to firmware version 3.4-RC7 or newer. This update can be found by logging in at the following location:” support.cambiumnetworks.com
From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf
Exploit prediction
6.65% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit auxiliary/scanner/snmp/epmp1000_snmp_loot Cambium ePMP 1000 SNMP Enumeration metasploit auxiliary, normal rank
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 6.8 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:L |
| NVD | 2.0 | 6.0 | AV:N/AC:M/Au:S/C:P/I:P/A:P |
Affected products
- n/a Cambium Networks ePMP
Classification
References
-
securityfocus.com
/bid/99083
vdb-entry, third-party-advisory, us-government-resource
-
ics-cert.us-cert.gov
/advisories/ICSA-17-166-01
third-party-advisory, us-government-resource
Sources
- CVE List CVE-2017-7918
- NVD CVE-2017-7918
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.