Vulnerability record · CVE-2010-5330 · published 11 June 2019
CVE-2010-5330: Ubiquiti AirOS command injection in stainfo.cgi ifname parameter
Ui · Airos
Ubiquiti AirOS devices fail to sanitize the ifname variable in a GET request to stainfo.cgi, allowing shell metacharacters to be injected into a command. This lets an unauthenticated remote attacker execute arbitrary commands on the device. The flaw is fixed in v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware.
Description
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, unauthenticated remote command execution, CISA KEV listing and a public exploit make this a top-priority patch.
What it is
Ubiquiti AirOS devices fail to sanitize the ifname variable in a GET request to stainfo.cgi, allowing shell metacharacters to be injected into a command. This lets an unauthenticated remote attacker execute arbitrary commands on the device. The flaw is fixed in v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware.
Impact
An attacker gains arbitrary command execution on the affected device, with full loss of confidentiality, integrity and availability as reflected by the CVSS 9.8 score. This can lead to full device compromise and use of the device as a foothold into the network.
Attack surface
The flaw is reached over the network via a crafted GET request to stainfo.cgi, with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any host that can reach the device's web interface can attempt it.
Exploitation
CVE-2010-5330 is listed in CISA KEV (added 2022-04-15) and has a public Exploit-DB entry, indicating known exploitation in the wild. EPSS is 0.338 (98.3rd percentile), so exploitation is considered likely.
What to do
- Upgrade to the fixed firmware: v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, or v5.4.5 for AirSync firmware.
- If immediate patching is not possible, restrict management access to the device web interface to trusted networks only.
- Disable or block external access to the stainfo.cgi endpoint until the device is patched.
- Segment affected AirOS devices from the rest of the network to limit lateral movement after compromise.
Detection
- Monitor web server or device logs for GET requests to stainfo.cgi containing shell metacharacters such as ;, |, $, or backticks in the ifname parameter.
- Alert on unexpected outbound connections or processes spawned on AirOS devices that are not part of normal management traffic.
- Use network monitoring to flag requests to stainfo.cgi from hosts outside the expected management subnet.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2010-5330 to the Known Exploited Vulnerabilities catalog on 15 April 2022 as "Ubiquiti AirOS Command Injection Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 6 May 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974 | Issue TrackingPatchVendor Advisory |
| https://www.exploit-db.com/exploits/14146 | Third Party AdvisoryVDB Entry |
| https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974 | Issue TrackingPatchVendor Advisory |
| https://www.exploit-db.com/exploits/14146 | Third Party AdvisoryVDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5330 | US Government Resource |
Track CVE-2010-5330 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2010-5330), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
