Affected platforms: All platforms
Affected versions: 4.7.0, 5.3.0 and above
Network security vulnerabilities are constantly evolving as threat actors seek new and intuitive ways to gain access to a business’s network). Cambium Networks is constantly monitoring and preventing the equipment security risks.
Current changes follow recently discovered security risks in users authentication algorithms and equipment configurations via SNMP. They affect default password and SNMP communities behavior. Now they can be used in completely default configuration only. As soon as the user starts to prepare the radio for a network deployment all default passwords and SNMP communities must be changed.
Since FW 4.7.0 and 5.3.0 user passwords and SNMP Read-Write Community Strings should be at least 8 characters.
The SNMP remote access is disabled by default for the following scenarios:
- If the radio is upgraded from Firmware versions 5.1.3 or below to 5.3-RC14 or newer Firmware version and default SNMP community strings are configured.
- If the configuration file from 5.1.3 or earlier Firmware is restored to the device.
- If the radio is reset to default on 5.3-RC14 or newer Firmware
Out of the box radio with 5.3.0 and default configuration:
-
On the first GUI login with admin/admin credentials the next pop-up window is shown and you can not skip it:
-
After password save SNMP access and user accounts except admin account are disabled:
Next notification is shown:
If the radio is upgraded from 5.1.3 or to the below version, then the following notifications appears:
-
If the admin user password is default, then the user gets a window to change it. Change the default password or disable the account.
-
If one or both SNMP communities are default and SNMP access is disabled as shown below:
The notification appears as shown below:
-
After enabling SNMP Remote Access, a pop-up notification is shown as below:
-
If the radio has non-default admin password, then the user can perform the operations.
To set SNMP access enabled, define community strings, enable accounts and set passwords via CnMaestro use next template:
{
"device_props": {
"snmpRemoteAccess": "1",
"snmpReadOnlyCommunity": "cambium123",
"snmpReadWriteCommunity": "cambium123",
"cambiumSysAccountsTable": [{
"cambiumSysAccountsName": "admin",
"cambiumSysAccountsHash": "$1$\/4mFIcf4$BDYKtSYVUkfl7rijAVG\/a1",
"cambiumSysAccountsUID": "1000",
"cambiumSysAccountsGID": "4",
"cambiumSysAccountsDir": "\/tmp",
"cambiumSysAccountsShell": "\/usr\/bin\/clish"
},
{
"cambiumSysAccountsName": "installer",
"cambiumSysAccountsHash": "$1$TzjSMihI$I4VIkvOX9.5mILd\/i9NlJ\/",
"cambiumSysAccountsUID": "2000",
"cambiumSysAccountsGID": "100",
"cambiumSysAccountsDir": "\/tmp",
"cambiumSysAccountsShell": "\/bin\/false"
},
{
"cambiumSysAccountsName": "home",
"cambiumSysAccountsHash": "$1$TzjSMihI$I4VIkvOX9.5mILd\/i9NlJ\/",
"cambiumSysAccountsUID": "3000",
"cambiumSysAccountsGID": "100",
"cambiumSysAccountsDir": "\/tmp",
"cambiumSysAccountsShell": "\/bin\/false"
},
{
"cambiumSysAccountsName": "readonly",
"cambiumSysAccountsHash": "$1$Y9oz6eRg$ysokBk9VZCGo4AN6WQgVF0",
"cambiumSysAccountsUID": "4000",
"cambiumSysAccountsGID": "100",
"cambiumSysAccountsDir": "\/tmp",
"cambiumSysAccountsShell": "\/bin\/false"
},
{
"cambiumSysAccountsName": "dashboard",
"cambiumSysAccountsHash": "$1$Y9oz6eRg$ysokBk9VZCGo4AN6WQgVF0",
"cambiumSysAccountsUID": "5000",
"cambiumSysAccountsGID": "100",
"cambiumSysAccountsDir": "\/tmp",
"cambiumSysAccountsShell": "\/bin\/false"
}
]
}
}
The only way to generate the hash is by changing the password on a radio and reading it from the configuration file.
Validate the json before loading it into cnMaestro!
Useful links about templates in cnMaestro:
How to use templates
How to create Templates in cnMaestro for ePMP radio