9.8Crítica
KEV
CVE-2010-5330Ubiquiti AirOS Command Injection Vulnerability
Explotación conocida — Ubiquiti AirOS Command Injection Vulnerability
CISA confirmó el 15.04.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 06.05.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2010-5330
Descripción
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
Debilidad (CWE):
CWE-77
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
Referencias y parches
- https://www.exploit-db.com/exploits/14146 Third Party AdvisoryVDB Entry
- https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974 Issue TrackingPatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5330 US Government Resource
Coincidencias CPE (NVD) (3)
cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:*< 4.0.1cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:*≥ 4.0.2 < 5.3.5cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:*≥ 5.3.6 < 5.4.5