VULNERABILITY INTELLIGENCE

CVE-2010-5330

CVSS score9.8 CRITICAL

EPSS probability40.23%

CISA KEVKnown exploited vulnerability

Published2019-06-11

Last modified2026-06-16

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Ubiquiti AirOS Command Injection Vulnerability

Vendor / product: Ubiquiti / AirOS

Description

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

Weakness classification

CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Primary references

cve@mitre.org — Issue Tracking, Patch, Vendor Advisory
cve@mitre.org — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource