Skip to content
OpenAdvisories
Critical · 9.8 Known exploited CVE-2010-5330 EUVD-2010-5287GHSA-c5j2-ggvf-gwvg

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is no…

Published Jun 11, 2019 · Updated Oct 21, 2025 · Assigned by mitre

Description

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

References