CVE-2010-5330: Ubiquiti AirOS Command Injection Vulnerability
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Other sources
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Ubiquiti AirOS (802.11 ISP products)to a version that resolves this vulnerability.Fixed in v4.0.1 - Upgrade
Upgrade
Ubiquiti AirOS (AirMax ISP products)to a version that resolves this vulnerability.Fixed in v5.3.5 - Upgrade
Upgrade
Ubiquiti AirOS (AirSync firmware)to a version that resolves this vulnerability.Fixed in v5.4.5 - Compensating control
To mitigate command injection via GET requests to stainfo.cgi (aka Show AP info), restrict/limit access to the stainfo.cgi endpoint so unauthenticated users cannot reach it (e.g., via network ACL/firewall/WAF or isolation), until the affected AirOS version is updated.
Event History
Frequently Asked Questions
What is CVE-2010-5330?
CVE-2010-5330 is a vulnerability titled Ubiquiti AirOS Command Injection Vulnerability.
What is the severity of CVE-2010-5330?
CVE-2010-5330 has a severity rating of 9.8 (critical).
How does CVE-2010-5330 affect Ubiquiti AirOS devices?
CVE-2010-5330 affects certain Ubiquiti AirOS devices by allowing command injection via a GET request to stainfo.cgi.
Which versions of Ubiquiti AirOS are affected by CVE-2010-5330?
Versions up to and including v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync are affected by CVE-2010-5330.
How can I fix the Ubiquiti AirOS Command Injection Vulnerability (CVE-2010-5330)?
To fix CVE-2010-5330, you should update your Ubiquiti AirOS devices to the fixed versions: v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync.