CVE-2010-5330: Ubiquiti AirOS Command Injection Vulnerability

Vulnerability summary

CVE-2010-5330 is a critical (CVSS 9.8) Command Injection vulnerability in Ubiquiti AirOS. It is known to be exploited: CISA lists it, first on 15-04-2022. EPSS estimates a 40.23% chance of exploitation in the next 30 days, higher than 98.6% of scored vulnerabilities.

Timeline

1. 11-06-2019
   PublishedVulnerability first disclosed.
2. 15-04-2022
   Added to CISA KEVUbiquiti AirOS Command Injection Vulnerability
3. 06-05-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.