Read the docs
TI-2022-00081 Aliases CVE-2022-0138GHSA-r92v-ww59-8xpg

Airspan Networks Mimosa Deserialization of Untrusted Data

Priority MEDIUM 41CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-502.

Summary

MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 has a deserialization function that does not validate or check the data, allowing arbitrary classes to be created.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00986 62nd percentileScored 2026-11-07
Fix Fixed MMP (Airspan Networks): v1.0.3PTP C-series (Airspan Networks): v2.8.6.1+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AirspanMMPbefore v1.0.3v1.0.3Patch availableCNA
AirspanPTP C-seriesbefore v2.8.6.1v2.8.6.1Patch availableCNA
AirspanPTMP C-series and A5xbefore v2.5.4.1v2.5.4.1Patch availableCNA
  • MMP VendorAirspan Affected before v1.0.3 Fixed in v1.0.3 Patch available CNA
  • PTP C-series VendorAirspan Affected before v2.8.6.1 Fixed in v2.8.6.1 Patch available CNA
  • PTMP C-series and A5x VendorAirspan Affected before v2.5.4.1 Fixed in v2.5.4.1 Patch available CNA

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:a:airspan:mimosa_management_platform:*:*:*:*:*:*:*:*before 1.0.3VulnerableAirspan
cpe:2.3:o:airspan:c6x_firmware:*:*:*:*:*:*:*:*before 2.8.6.1VulnerableAirspan
cpe:2.3:h:airspan:c6x:-:*:*:*:*:*:*:*not specified by NVDRunning onAirspan
cpe:2.3:o:airspan:c5x_firmware:*:*:*:*:*:*:*:*before 2.8.6.1VulnerableAirspan
cpe:2.3:h:airspan:c5x:-:*:*:*:*:*:*:*not specified by NVDRunning onAirspan
cpe:2.3:o:airspan:c5c_firmware:*:*:*:*:*:*:*:*before 2.8.6.1VulnerableAirspan
cpe:2.3:h:airspan:c5c:-:*:*:*:*:*:*:*not specified by NVDRunning onAirspan
cpe:2.3:o:airspan:a5x_firmware:*:*:*:*:*:*:*:*before 2.5.4.1VulnerableAirspan
cpe:2.3:h:airspan:a5x:-:*:*:*:*:*:*:*not specified by NVDRunning onAirspan
  • cpe:2.3:a:airspan:mimosa_management_platform:*:*:*:*:*:*:*:* Versions before 1.0.3 Vulnerable ·Airspan
  • cpe:2.3:o:airspan:c6x_firmware:*:*:*:*:*:*:*:* Versions before 2.8.6.1 Vulnerable ·Airspan
  • cpe:2.3:h:airspan:c6x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Airspan
  • cpe:2.3:o:airspan:c5x_firmware:*:*:*:*:*:*:*:* Versions before 2.8.6.1 Vulnerable ·Airspan
  • cpe:2.3:h:airspan:c5x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Airspan
  • cpe:2.3:o:airspan:c5c_firmware:*:*:*:*:*:*:*:* Versions before 2.8.6.1 Vulnerable ·Airspan
  • cpe:2.3:h:airspan:c5c:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Airspan
  • cpe:2.3:o:airspan:a5x_firmware:*:*:*:*:*:*:*:* Versions before 2.5.4.1 Vulnerable ·Airspan
  • cpe:2.3:h:airspan:a5x:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Airspan

Remediation

  • Fix · CNA MMP (Airspan Networks) Fixed in v1.0.3
  • Fix · CNA PTP C-series (Airspan Networks) Fixed in v2.8.6.1
  • Fix · CNA PTMP C-series and A5x (Airspan Networks) Fixed in v2.5.4.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Airspan Networks MMP, PTMP C-series and A5x, PTP C-series v1.0.3, v2.5.4.1, v2.8.6.1

    7 records Highest priority Priority MEDIUM 6 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2022-05592 Airspan Networks Mimosa Improper AuthorizationPriority MEDIUM 55
    • TI-2022-05544 Airspan Networks Mimosa Incorrect AuthorizationPriority MEDIUM 55
    • TI-2022-05608 Airspan Networks Mimosa Server-Side Request Forgery (SSRF)Priority MEDIUM 52
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-0138
  2. 2026-10-03 Alias added: GHSA-r92v-ww59-8xpg

References

Advisory 1

  • TI-2022-05592 Airspan Networks Mimosa Improper Authorization CVSS 3.1CRITICAL 10.0
  • TI-2022-05544 Airspan Networks Mimosa Incorrect Authorization CVSS 3.1CRITICAL 10.0
  • TI-2022-05608 Airspan Networks Mimosa Server-Side Request Forgery (SSRF) CVSS 3.1CRITICAL 10.0
  • TI-2022-05546 Airspan Networks Mimosa OS Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2022-05575 Airspan Networks Mimosa SQL Injection CVSS 3.1HIGH 8.6
  • TI-2022-06172 Airspan Networks Mimosa Use of a Broken or Risky Cryptographic Algorithm CVSS 3.1MEDIUM 6.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences