CVE-2022-21215

Airspan Networks Mimosa Server-Side Request Forgery (SSRF)

Description

This vulnerability could allow an attacker to force the server to create and execute a web request granting access to backend APIs that are only accessible to the Mimosa MMP server, or request pages that could perform some actions themselves. The attacker could force the server into accessing routes on those cloud-hosting platforms, accessing secret keys, changing configurations, etc. Affecting MMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1.

Remediation

Solution:

  • Airspan Networks recommends users update to following products (Login Required): MMP: Version 1.0.4 or later PTP: C5x: Version 2.90 or later C5c: Version 2.90 or later PTMP: C-series: Version 2.9.0 or later A5x: Version 2.9.0 or later

Category

10.0
CVSS
Severity: Critical
CVSS 3.1 •
CVSS 2.0 •
EPSS 0.23%
Third-Party Advisory cisa.gov
Affected: Airspan Networks MMP
Affected: Airspan Networks PTP C-series
Affected: Airspan Networks PTMP C-series and A5x
Published at:
Updated at:

References

Link Tags
https://www.cisa.gov/uscert/ics/advisories/icsa-22-034-02 third party advisory us government resource

Frequently Asked Questions

What is the severity of CVE-2022-21215?
CVE-2022-21215 has been scored as a critical severity vulnerability.
How to fix CVE-2022-21215?
To fix CVE-2022-21215: Airspan Networks recommends users update to following products (Login Required): MMP: Version 1.0.4 or later PTP: C5x: Version 2.90 or later C5c: Version 2.90 or later PTMP: C-series: Version 2.9.0 or later A5x: Version 2.9.0 or later
Is CVE-2022-21215 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2022-21215 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2022-21215?
CVE-2022-21215 affects Airspan Networks MMP, Airspan Networks PTP C-series, Airspan Networks PTMP C-series and A5x.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.