CVE-2022-21800
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedMMP: All versions prior to v1.0.3, PTP C-series: Device versions prior to v2.8.6.1, and PTMP C-series and A5x: Device versions prior to v2.5.4.1 uses the MD5 algorithm to hash the passwords before storing them but does not salt the hash. As a result, attackers may be able to crack the hashed passwords.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · high confidenceCambium Networks wireless devices (MMP, PTP C-series, PTMP C-series, and A5x) store user passwords using unsalted MD5 hashing. This weak cryptographic practice enables attackers to use pre-computed rainbow tables or offline cracking tools to recover plaintext passwords from captured password hashes.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data< 1.0.3< 2.8.6.1< 2.8.6.1< 2.8.6.1< 2.5.4.1CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Network
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify the device modelLocate the Airspan/Cambium device in your network inventory and determine the exact model (MMP, C6x, C5x, C5c, or A5x)Affected if The device is one of the models listed in the affected products
-
Check the firmware versionAccess the device web interface, CLI, or management console and retrieve the current firmware versionAffected if The installed version is below 1.0.3 for MMP, below 2.8.6.1 for C6x/C5x/C5c, or below 2.5.4.1 for A5x
-
Locate stored password hashesExamine configuration backups, shadow files, or database files where user credentials are stored on the deviceAffected if Password hashes are present and appear as 32-character MD5 strings without salt
-
Verify hashing mechanismIf you can access the password storage location, check whether the hash format includes a salt component or uses a modern algorithm like bcrypt or scryptAffected if Passwords are stored as plain MD5 hashes without any salt value
-
Compare against fixed versionsAfter checking the current version, compare it to the patched releases: MMP v1.0.3, C-series v2.8.6.1, A5x v2.5.4.1Affected if The device version is below the fixed version for that product line
You are affected if your device model matches Airspan MMP, C6x, C5x, C5c, or A5x AND the installed firmware version is below the corresponding fixed version (1.0.3, 2.8.6.1, or 2.5.4.1), with passwords stored using unsalted MD5 hashing.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
dbcve · scoped1.0.32.5.4.12.8.6.1
Upgrade device firmware to the fixed versions: MMP to v1.0.3, PTP C-series to v2.8.6.1, and PTMP C-series/A5x to v2.5.4.1. After patching, force password changes for all user accounts as a precaution.
MMP v1.0.3, C6x/C5x/C5c firmware v2.8.6.1, A5x firmware v2.5.4.1
- 1. Identify the Mimosa device model and current firmware/software version
- 2. For Mimosa Management Platform (MMP): Upgrade to version 1.0.3 or later
- 3. For C6x, C5x, or C5c devices: Upgrade firmware to version 2.8.6.1 or later
- 4. For A5x devices: Upgrade firmware to version 2.5.4.1 or later
- 5. After upgrade, ensure all user passwords are reset to enforce the new secure hashing mechanism
- 6. Verify the upgrade was successful by checking the firmware/software version
Generated from the published advisory — verify against the referenced sources before acting.
- Consultation2.0 h
- Implementation4.0 h
- Testing3.0 h
- Review / QA1.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,800.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2022-21800 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2022-21800 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data