← Zuruck zu CVEs

CVE-2010-5330

CRITICALCISA KEV

9.8

Beschreibung

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

CVE Details

CVSS v3.1 Bewertung9.8

SchweregradCRITICAL

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienNONE

BenutzerinteraktionNONE

Veroffentlicht6/11/2019

Zuletzt geandert11/5/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerUbiquiti

ProduktAirOS

SchwachstellennameUbiquiti AirOS Command Injection Vulnerability

KEV Aufnahmedatum2022-04-15

Behebungsfrist2022-05-06

Ransomware-NutzungUnknown

Betroffene Produkte

ui:airos

Schwachen (CWE)

CWE-77CWE-77

Referenzen

https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974(cve@mitre.org)

https://www.exploit-db.com/exploits/14146(cve@mitre.org)

https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974(af854a3a-2127-422b-91ae-364da2661108)

https://www.exploit-db.com/exploits/14146(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5330(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.