Read the docs
TI-2022-01244 Aliases CVE-2022-1362GHSA-qg5x-rr96-mrpg

Cambium Networks cnMaestro OS Command Injection

Priority LOW 34CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-78.

Summary

The affected On-Premise cnMaestro is vulnerable inside a specific route where a user can upload a crafted package to the system. An attacker could abuse this user-controlled data to execute arbitrary commands on the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00816 57th percentileScored 2026-11-07
Fix Fixed cnMaestro (Cambium Networks): 3.0.3-r32, 2.4.2-r29, 3.0.0-r34

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Cambium NetworkscnMaestrobefore 3.0.3-r32; before 2.4.2-r29; before 3.0.0-r343.0.3-r32, 2.4.2-r29, 3.0.0-r34Patch availableCNA
  • cnMaestro VendorCambium Networks Affected before 3.0.3-r32; before 2.4.2-r29; before 3.0.0-r34 Fixed in 3.0.3-r32, 2.4.2-r29, 3.0.0-r34 Patch available CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:o:cambiumnetworks:cnmaestro:2.4.2:*:*:*:on_premises:*:*:*2.4.2VulnerableCambiumnetworks
cpe:2.3:o:cambiumnetworks:cnmaestro:3.0.0:*:*:*:on_premises:*:*:*3.0.0VulnerableCambiumnetworks
cpe:2.3:o:cambiumnetworks:cnmaestro:3.0.3:*:*:*:on_premises:*:*:*3.0.3VulnerableCambiumnetworks
  • cpe:2.3:o:cambiumnetworks:cnmaestro:2.4.2:*:*:*:on_premises:*:*:* Versions 2.4.2 Vulnerable ·Cambiumnetworks
  • cpe:2.3:o:cambiumnetworks:cnmaestro:3.0.0:*:*:*:on_premises:*:*:* Versions 3.0.0 Vulnerable ·Cambiumnetworks
  • cpe:2.3:o:cambiumnetworks:cnmaestro:3.0.3:*:*:*:on_premises:*:*:* Versions 3.0.3 Vulnerable ·Cambiumnetworks

Remediation

  • Fix · CNA cnMaestro (Cambium Networks) Fixed in 3.0.3-r32, 2.4.2-r29, 3.0.0-r34

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Cambium Networks cnMaestro 2.4.2-r29, 3.0.0-r34, 3.0.3-r32

    7 records Highest priority Priority MEDIUM 2 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2022-01239 Cambium Networks cnMaestro OS Command InjectionPriority MEDIUM 52
    • TI-2022-01242 Cambium Networks cnMaestro OS Command InjectionPriority MEDIUM 46
    • TI-2022-01243 Cambium Networks cnMaestro SQL InjectionPriority LOW 37
    Show all 7 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-1362
  2. 2026-10-03 Alias added: GHSA-qg5x-rr96-mrpg

References

Advisory 1

  • TI-2017-03362 OS command injection in Cambium Networks ePMP CVSS 3.0HIGH 8.8
  • TI-2017-03361 Improper access control in Cambium Networks ePMP CVSS 3.0HIGH 8.8
  • TI-2017-03366 Cleartext transmission of sensitive information in Cambium Networks cnPilot CVSS 3.0HIGH 8.8
  • TI-2022-01239 Cambium Networks cnMaestro OS Command Injection CVSS 3.1CRITICAL 9.8
  • TI-2017-03368 Path traversal in Cambium Networks cnPilot CVSS 3.0HIGH 8.8
  • TI-2017-03367 Incorrect permission assignment in Cambium Networks cnPilot CVSS 3.0HIGH 8.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences