CVEvulnerability

CVE-2010-5330

9.8 CRITICAL Known exploited Published 2019-06-11 Modified 2026-06-16 Official page ↗

CISA Known Exploited Vulnerability

Ubiquiti AirOS Command Injection Vulnerability — Ubiquiti AirOS

Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.

Added to KEV
2022-04-15
Remediation due
2022-05-06
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2010-5330
Status
Analyzed
Published
2019-06-11
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-77

Description

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

Affected configurations

• ui airos (< 4.0.1) • ui airos (>= 4.0.2 < 5.3.5) • ui airos (>= 5.3.6 < 5.4.5)

Related

Weakness · CWE (1)

  • CWE-77 Improper Neutralization of Special Elements used in a Command weakness

References