CVE-2022-36309: Airspan Airvelocity 1500 Firmware

High severity, CVSS 8.8. EPSS: 24.6% chance of exploitation in the next 30 days.

Airspan AirVelocity 1500 software versions prior to 15.18.00.2511 have a root command injection vulnerability in the ActiveBank parameter of the recoverySubmit.cgi script running on the eNodeB's web management UI. This issue may affect other AirVelocity and AirSpeed models.

Affected products

• Airspan Airvelocity 1500 Firmware: from 9.3.0.01249, up to and including 15.18.00.2511

Published 2022-08-16. Last modified 2026-06-17.