Critical severity · published Sep 5, 2018
CVE-2015-9266
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary…
9.8
CVSS
74%
EPSS
No
On KEV
Description
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)74.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
Af5 Firmware · UI
before 2.2.1 · source: NVD
AF
Af5x Firmware · UI
before 3.0.2.1 · source: NVD
AA
Airfiber Af24 Firmware · UI
before 2.2.1 · source: NVD
AA
Airfiber Af24hd Firmware · UI
before 2.2.1 · source: NVD
AF
Airgateway Firmware · UI
before 1.15 · source: NVD
AA
Airmax AC Firmware · UI
7.1.3 · source: NVD
AM
Airmax M TI Firmware · UI
before 5.6.2 · source: NVD
AM
Airmax M XM Firmware · UI
before 5.6.2 · source: NVD
AM
Airmax M XW Firmware · UI
before 5.6.2 · source: NVD
A4
Airos 4 Xs2 · Ubnt
before 4.0.4 · source: NVD
A4
Airos 4 Xs5 · Ubnt
before 4.0.4 · source: NVD
EX
Edgeswitch XP Firmware · Ubnt
before 1.3.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-9266
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-9266
Vendor Advisory
https://community.ubnt.com/t5/airMAX-General-Discussion/Virus-attack-URGENT-UBNT/td-p/1562940
Vendor Advisory
https://community.ubnt.com/t5/airMAX-Updates-Blog/Important-Security-Notice-and-airOS-5-6-5-Release/ba-p/1565949
Patch
https://community.ubnt.com/t5/airMAX-Updates-Blog/Security-Release-for-airMAX-TOUGHSwitch-and-airGateway-Released/ba-p/1300494
Issue Tracking
https://hackerone.com/reports/73480
Exploit
https://www.exploit-db.com/exploits/39701/
Exploit
https://www.exploit-db.com/exploits/39853/