CVE-2022-1360
📋 TL;DR
CVE-2022-1360 is an OS command injection vulnerability in Cambium Networks cnMaestro On-Premise that allows remote attackers to execute arbitrary commands on the server. This affects organizations running vulnerable versions of cnMaestro On-Premise, potentially allowing attackers to change server configurations or gain full control.
💻 Affected Systems
- Cambium Networks cnMaestro On-Premise
📦 What is this software?
Cnmaestro by Cambiumnetworks
Cnmaestro by Cambiumnetworks
Cnmaestro by Cambiumnetworks
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the cnMaestro server leading to network-wide disruption, data theft, and lateral movement to other network devices.
Likely Case
Unauthorized configuration changes, service disruption, and potential installation of backdoors or malware.
If Mitigated
Limited impact with proper network segmentation and access controls, potentially only affecting the cnMaestro instance itself.
🎯 Exploit Status
Exploitation requires network access to the cnMaestro instance but no authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 3.0.0 and later
Vendor Advisory: https://www.cambiumnetworks.com/support/cve-2022-1360/
Restart Required: Yes
Instructions:
1. Download cnMaestro On-Premise version 3.0.0 or later from Cambium support portal. 2. Backup current configuration. 3. Install the update following Cambium's upgrade documentation. 4. Verify the update completed successfully.
🔧 Temporary Workarounds
Network Isolation
allRestrict network access to cnMaestro management interface to trusted IP addresses only.
Use firewall rules to limit access to cnMaestro ports (typically 443/HTTPS) to authorized management networks only.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate cnMaestro from critical network segments
- Monitor cnMaestro logs for unusual command execution or configuration changes
🔍 How to Verify
Check if Vulnerable:
Check cnMaestro version via web interface (Admin > System > About) or SSH to appliance and check version.Check Version:
ssh admin@cnmaestro-ip 'cat /etc/cnmaestro/version' or check web interface at Admin > System > AboutVerify Fix Applied:
Confirm version is 3.0.0 or later in the web interface or via command line.📡 Detection & Monitoring
Log Indicators:
- Unusual command execution in system logs
- Unexpected configuration changes
- Failed authentication attempts followed by successful access
Network Indicators:
- Unusual outbound connections from cnMaestro server
- Traffic to unexpected ports from cnMaestro
SIEM Query:
source="cnmaestro" AND (event_type="command_execution" OR event_type="config_change")