Ubiquiti Inc.: XSS on Nanostation Loco M2 Airmax

The researcher demonstrated that an unauthenticated POST request with crafted parameters could cause reflected-XSS due to lack of input sanitization on airOS v5.6.8. Fixes have been released with airOS v5.6.15 and airOS v6.0.1...

Ubiquiti Inc.: Reflected Xss in AirMax [Nanostation Loco M2]

Dear James, I've found a reflected xss in nanostation Loco M2. just open this link and xss will execute. http://172.98.67.89:22057/survey.cgi?iface=%22%3E%3Cimg%20src=x%20onerror=promptdocument.cookie%3E F103333 Best Regard Shubham...

Ubiquiti Network Gear Targeted By Worm

ISP equipment maker Ubiquiti Networks is fending off a stubborn worm targeting its networking equipment running outdated AirOS firmware. According to security experts, the worm is already being blamed for crippling networking gear in the Argentina, Brazil, Spain and the United States. Ubiquiti...

AirOS 6.x - Arbitrary File Upload

Exploit for cgi platform in category web applications EDB-Note Source: https://hackerone.com/reports/73480 Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's...

AirOS 6.x Arbitrary File Upload

Vulnerability It's possible to overwrite any file and create new ones on AirMax systems, because the "php2" maybe because of a patch don't verify the "filename" value of a POST request. It's possible to a unauthenticated user to exploit this vulnerability. Example Consider the following request:...

Ubiquiti Inc.: Yet another Buffer Overflow in PHP of the AirMax Products

It's me again! After the Report 73491 and the 74004, I bring another Buffer Overflow, this one look more like 74004, which is a overflow in stack. Has you can see bellow, is copied to the var line a content POST data in this case which can go beyond the content of the original variable. int...

Ubiquiti Inc.: Other Buffer Overflow in PHP of the AirMax Products

tldr: Just like happen in Report 73491, but MUCH WORSE. The Vulnerability After the Report 73491, I decided to take another look in the code on filespost.c and uploadbuffer.c once I have nothing better to do than watch F1. The problematic code: char getpostvoid / Some Code / char mb; char...

Ubiquiti Inc.: Buffer Overflow in PHP of the AirMax Products

Vulnerability The function static int ubnormalizefilenamechar filename implemented by the patch 430-smart-post-upload.patch in the file uploadbuffer.c on the SDK.UBNT.v5.5 have the following code: static int ubnormalizefilenamechar filename char fwdslash; char backslash; sizet size; / Some commen...