CVE-2023-6691
📋 TL;DR
Cambium ePMP Force 300-25 version 4.7.0.1 contains a code injection vulnerability that allows remote attackers to execute arbitrary code with root privileges. This affects organizations using this specific wireless access point version for network infrastructure.
💻 Affected Systems
- Cambium ePMP Force 300-25
📦 What is this software?
Epmp Force 300 25 Firmware by Cambiumnetworks
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root access, allowing attacker to pivot to other network segments, steal data, or deploy ransomware.
Likely Case
Attacker gains persistent access to network infrastructure, intercepts traffic, and potentially disrupts wireless services.
If Mitigated
Limited impact due to network segmentation and strict access controls preventing lateral movement.
🎯 Exploit Status
CWE-94 indicates improper control of generation of code, suggesting relatively straightforward exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check Cambium advisory for latest secure version
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-01
Restart Required: Yes
Instructions:
1. Check current firmware version
2. Download latest firmware from Cambium support portal
3. Upload firmware via web interface
4. Reboot device after installation
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate VLAN with strict firewall rules
Access Control
allRestrict management interface access to trusted IP addresses only
🧯 If You Can't Patch
- Immediately isolate affected devices from internet and critical networks
- Implement strict network monitoring and alerting for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check device web interface or CLI for firmware version 4.7.0.1Check Version:
Check web interface System Status page or use SNMP queryVerify Fix Applied:
Confirm firmware version has been updated to patched version📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Configuration changes
- Unexpected reboots
Network Indicators:
- Unusual outbound connections from access point
- Traffic spikes
- Port scanning from device
SIEM Query:
source="epmp" AND (event="configuration_change" OR event="firmware_update")