CVE-2010-5330 Information

Description

On certain Ubiquiti devices Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products v5.3.5 for AirMax ISP products and v5.4.5 for AirSync firmware. For example Nanostation5 (Air OS) is affected.

CVSS Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Reference

https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974 https://www.exploit-db.com/exploits/14146

Attack Complexity

LOW

Privileges Required

NONE

User Interaction Required

NONE

Scope

NONE

Confidentiality Impact

UNCHANGED

Integrity Impact

HIGH

Availability Impact

HIGH

Base Score

HIGH

Base Severity

9.8