In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available…

published 2017-12-20 8 y ago modified 2026-06-17 4 mo ago also EUVD-2017-14365

cvss: 8.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 8.1%; EPSS 8.1% chance of exploitation in 30 days, percentile 94%
public exploits: 1; Metasploit

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, although the option to access the configuration file is not available in the normal web administrative console for the 'user' account, the configuration file is accessible via direct object reference (DRO) at http://<device-ip-or-hostname>/goform/down_cfg_file by this otherwise low privilege 'user' account.

Exploit prediction

8.13% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

Metasploit auxiliary/scanner/http/cnpilot_r_web_login_loot Cambium cnPilot r200/r201 Login Scanner and Config Dump metasploit auxiliary, normal rank

CVSS scores

assigned by	version	score	vector
NVD	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	9.0	AV:N/AC:L/Au:S/C:C/I:C/A:C

Affected products

Cambium Networks cnPilot

Classification

Weakness

CWE-472 External Control of Assumed-Immutable Web Parameter
CWE-732 Incorrect Permission Assignment for Critical Resource

References

blog.rapid7.com /2017/12/19/r7-2017-25-cambium-epmp-and-cnpilot-multiple-vulnerabilities/
third-party-advisory

Sources

CVE List CVE-2017-5260
NVD CVE-2017-5260

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary