Ubiquiti AirOS Command Injection (CVE-2010-5330)

A command injection vulnerability exists in Ubiquiti AirOS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2010-5330

creationtimestamp| type| source ---|---|--- 2019-06-12 00:30:28+00:00| seen| https://t.me/cibsecurity/4851 2023-06-14 21:10:03+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:30:35+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971521 2025-02-23 02:10:01+00:00| see...

CVE-2010-5330

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi aka Show AP info because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSyn...

CVE-2010-5330

CVE-2010-5330 covers a command injection in Ubiquiti devices via GET to stainfo.cgi. The issue arises because the ifname parameter is not sanitized, enabling shell metacharacters to be injected. Affected families include Ubiquiti AirOS (before 4.0.1), AirMax ISP products (before 5.3.5), and AirSy...