I work at small WISP. A mix of Cambium and Ubnt. Our Cambium customers(force 180s) have gotten hit with Malware (5 billionth search) After eliminating everything device, I found that reset/reconfig of radio, would fix problem. It seemed to work, for a couple of days. Now I’m starting to ge…

What are the exhibited symptoms of this malware infection on the radios? What firmware are you running on them?

We are using 4.6.2. The firmware redirects websites to "5 billionth search " scam. When I reset and reconfigure, it fixes problem, but some have now been hit again. It’s affecting a large percentage of our Cambiums.

I would make sure you have firewall rules in place to block input to the radio management from anything but your known good IP addresses. Generally speaking I would never suggest having the radios be externally reachable but I understand this is a common practice.

re your radio acting as nat? bridge? Do they serve dhcp?

I’ve posted cnMaestro template instructions and JSON script to disable all accounts BUT the admin account. You can find it here: [image] Epmp hacked? unexplainable traffic/malware? ePMP To create a new template that you can push out to devices onboarded into cnMaestro, fi…

Why are there so many default accounts on some of the Cambium equipment ? It just seems like bad security posture in general. Luckily all our 180’s have installer,home and read-only account as disabled. We made specific templates to disable all these accounts when we rolled out 180’s for this exac…

NOTICE Cambium Networks acknowledge persistence of the issue with unauthorized configuration changes. Primarily DNS settings are affected but other settings can be affected too. Issue can be observed with all firmware versions. Presumably the attack is performed via default user passwords and snm…

I gues general network security isnt as well implemented as its supposed to be. Here is our basic network security in suggestion form: (we actually do this) Accounts that are not in use should be disabled after you change the password for it. This is important as physical attacks (customer or stol…

Any news about how to fix this problem? We are also experiencing same issue.

Brubble1’s answer is the most complete!

Malware/Virus on Our Cambium system

Products ePMP

Eric_Ozrelic (Eric Ozrelic) June 5, 2022, 5:46am 8

I’ve posted cnMaestro template instructions and JSON script to disable all accounts BUT the admin account. You can find it here: