CVE-2010-5330

KEVUbiquiti AirOS Command Injection Vulnerability

Description

Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

CVSS 3.1 vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

PublishedJun 11, 2019

Last modifiedJun 16, 2026

Added to KEVApr 15, 2022

Remediation dueMay 6, 2022

References

community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974Issue TrackingPatch
exploit-db.com/exploits/14146Third Party AdvisoryVDB Entry
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5330US Government Resource

0 recent articles mention this CVE

Risk assessment · Critical

Actively exploited. Patch immediately.

Exploitation: Confirmed in the wild (CISA KEV)
Federal remediation deadline: Overdue by 1635 days
CVSS: 9.8 CRITICAL
EPSS (30-day exploit probability): 40.2% · top 1% of all CVEs
Weakness: CWE-77
Attack vector: Network, remotely reachable
Preconditions: No privileges and no user interaction

Recommended actions

1.Apply updates per vendor instructions.
2.Treat as emergency change: patch or isolate internet-facing instances first.
3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.

Assessment is derived automatically from the live signals above; verify against your own asset inventory.