Critical severity · published Jun 11, 2019
CVE-2010-5330
Ubiquiti AirOS Command Injection Vulnerability
In wildKEV
9.8
CVSS
40.2%
EPSS
Yes
On KEV
Description
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)40.2% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Apr 15, 2022
Federal remediation dueMay 6, 2022
Ransomware campaign useNot known
Affected products
Which versions
AI
Airos · UI
before 4.0.1; 4.0.2 before 5.3.5; 5.3.6 before 5.4.5 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2010-5330
CVE.org
https://www.cve.org/CVERecord?id=CVE-2010-5330
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_MISC
https://www.exploit-db.com/exploits/14146
x_refsource_MISC
https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974
More from Airos
9.8
CVE-2020-8171
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM…
8.8
CVE-2020-8168
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM…
7.5
CVE-2017-0938
Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks
6.1
CVE-2020-8170
We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM…