{"schemaVersion":3,"id":"CVE-2020-8170","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:Multiple end-points with parameters vulnerable to reflected cross site scripting (XSS), allowing attackers to abuse the user' session information and/or account takeover of the admin user.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.","dates":{"published":"2020-05-26T15:37:27.000Z","modified":"2024-08-04T09:56:27.421Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":6.1,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"NVD","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":6.1,"severity":"medium","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.3,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.0102,"percentile":0.6282,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.0102},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0102,"percentile":0.6282}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.0102,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.0102,"percentile":0.6282}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.","type":"weakness","status":"Stable","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/79.html"}],"affected":[{"vendor":"ui","product":"airos","name":"airos","label":"airos","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"≤ 6.2.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 6.2.0","eol":null,"hubHref":"/vendor/ui/airos"}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://www.ui.com/download/airmax-m","label":"www.ui.com/download/airmax-m","hostname":"www.ui.com","tags":["X Refsource MISC","Release Notes","Third Party Advisory"]},{"url":"https://community.ui.com/releases/Security-advisory-bulletin-010-010/36a8448a-7dbf-4d30-bb54-398c44591dd4","label":"community.ui.com/releases/Security-advisory-bulletin-010-010/36a8448a-7dbf-4d30-bb54-398c44591dd4","hostname":"community.ui.com","tags":["X Refsource MISC","Vendor Advisory"]},{"url":"https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83","label":"community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83","hostname":"community.ui.com","tags":["X Refsource MISC","Vendor Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2020-05-26T15:37:27.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-04T09:56:27.421Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":25,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T02:46:31.097Z","stale":false,"partial":false}}