ICS Advisory: Cambium ePMP 5GHz Force 300-25 Radio

Summary:

A vulnerability has been identified in the Cambium ePMP Force 300-25 radio, version 4.7.0.1, which could allow an attacker to perform remote code execution and gain root privileges. The vulnerability, rated CVSS v3 7.8, is a code injection weakness (CWE-94) that allows an attacker to inject malicious code. The affected product is used in critical infrastructure sectors, such as communications, and is deployed worldwide. The vendor, Cambium, has not responded to requests to work with CISA to mitigate the vulnerability, and users are advised to take defensive measures to minimize the risk of exploitation.