Vulnerability Details CVE-2010-5330
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.559
EPSS Ranking 97.9%
CVSS Severity
CVSS v3 Score 9.8
CVSS v2 Score 5.0
Proposed Action
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Ransomware Campaign
Unknown
References
Products affected by CVE-2010-5330
-
cpe:2.3:o:ui:airos:*
-
cpe:2.3:o:ui:airos:3.0
-
cpe:2.3:o:ui:airos:3.0.2
-
cpe:2.3:o:ui:airos:3.0.2.1
-
cpe:2.3:o:ui:airos:3.2
-
cpe:2.3:o:ui:airos:3.2.1
-
cpe:2.3:o:ui:airos:3.6.1
-
cpe:2.3:o:ui:airos:4.0
-
cpe:2.3:o:ui:airos:4.0.2
-
cpe:2.3:o:ui:airos:4.0.3
-
cpe:2.3:o:ui:airos:4.0.4