Description
On Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas before 2026-03-10, the rfpiped service on TCP port 555 allows unauthenticated file uploads to any writable location on the device. File upload packets use weak encryption (metadata only) with file contents transmitted in cleartext. No authentication or path validation is performed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Ceragon Networks / Siklu Communication EtherHaul and MultiHaul Series microwave antennas
Default version status: unaffected
Ceragon MultiHaul MH-B100-CCS to < R2.4.0affectedCeragon MultiHaul MH-T200-CCC to < R2.4.0affectedCeragon MultiHaul MH-T200-CNN to < R2.4.0affectedCeragon MultiHaul MH-T201-CNN to < R2.4.0affectedCeragon EtherHaul EH-8010FX to < R10.8.1affectedCeragon EtherHaul EH-500TX to < R7.7.12affectedCeragon EtherHaul EH-600TX to < R7.7.12affectedCeragon EtherHaul EH-614TX to < R7.7.12affectedCeragon EtherHaul EH-700TX to < R7.7.12affectedCeragon EtherHaul EH-710TX to < R7.7.12affectedCeragon EtherHaul EH-1200TX to < R7.7.12affectedCeragon EtherHaul EH-1200FX to < R7.7.12affectedCeragon EtherHaul EH-2200FX to < R7.7.12affectedCeragon EtherHaul EH-2500FX to < R7.7.12affectedCeragon EtherHaul EH-5500FD to < R7.7.12affected