CVE-2010-5330

Summary

CVE-2010-5330 is a command injection vulnerability affecting certain Ubiquiti devices. The issue stems from the lack of sanitization of the ifname variable in a GET request to the stainfo.cgi file, also known as the Show AP info page. An attacker can exploit this vulnerability using shell metacharacters, potentially gaining control of the device. The affected products include 802.11 ISP devices, with a fixed version available in v4.0.1, and AirMax ISP products, which should be updated to v5.3.5. AirSync firmware should be updated to v5.4.5 to address this vulnerability in Nanostation5 (Air OS) and other affected devices.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.