{"id":"CVE-2010-5330","kind":"vulnerability","aliases":["CVE-2010-5330"],"related":[],"title":"Ubiquiti AirOS: Ubiquiti AirOS Command Injection Vulnerability","description":"On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.","summary":"Certain Ubiquiti AirOS devices accept a crafted GET request to stainfo.cgi that injects operating system commands. An unauthenticated attacker who can reach the device can run commands on it.","severity":"critical","cvss":9.8,"epss":0.40232,"exploited":true,"exploited_at":"2022-04-15T00:00:00+00:00","products":[{"name":"Ubiquiti AirOS","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["airos","exploited","infrastructure","self-hosted","ubiquiti"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the updates per vendor instructions (CISA KEV required action); the affected and fixed versions are not stated in the sources.","status":"open","published_at":"2019-06-11T21:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:17:47+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:17:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the updates per vendor instructions (CISA KEV required action); the affected and fixed versions are not stated in the sources.","reach":"unknown","impact":"high","summary":"Certain Ubiquiti AirOS devices accept a crafted GET request to stainfo.cgi that injects operating system commands. An unauthenticated attacker who can reach the device can run commands on it.","category":"infrastructure","who_cares":["ubiquiti","airos","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker runs arbitrary commands on the affected Ubiquiti device","analyst_note":"Find affected and fixed AirOS versions and whether stainfo.cgi needs auth, from the Ubiquiti advisory or the KEV entry at cisa.gov/known-exploited-vulnerabilities-catalog.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000468,"input_tokens":2822,"output_tokens":372,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2010':9A,12A '-5330':10A,13A '802.11':85C 'accept':27B 'affect':104C 'air':101C 'airmax':90C 'airo':2A,4A,16B,25B 'airos':15A 'airsync':96C 'aka':63C 'ap':65C 'attack':41B 'certain':23B,51C 'command':5A,38B,49B,54C 'craft':29B 'cve':8A,11A 'demonstr':75C 'devic':26B,46B,53C 'exampl':99C 'exist':56C 'exploit':17B 'firmwar':97C 'fix':80C 'get':30B,59C 'host':21B 'ifnam':69C 'info':66C 'infrastructur':18B 'inject':6A,35B,55C 'isp':86C,91C 'metacharact':78C 'nanostation5':100C 'oper':36B 'os':102C 'product':87C,92C 'reach':44B 'request':31B,60C 'run':48B 'sanit':73C 'self':20B 'self-host':19B 'shell':77C 'show':64C 'stainfo.cgi':33B,62C 'system':37B 'ubiqu':1A,3A,22B,24B,52C 'ubiquiti':14A 'unauthent':40B 'v4.0.1':83C 'v5.3.5':88C 'v5.4.5':94C 'variabl':70C 'version':81C 'via':57C 'vulner':7A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2019-06-11T21:29:00+00:00","kev":{"dateAdded":"2022-04-15","dueDate":"2022-05-06","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2010-5330","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-5330","severity":null,"published_at":"2022-04-15T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2010-5330","url":"https://api.first.org/data/v1/epss?cve=CVE-2010-5330","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2010-5330","url":"https://nvd.nist.gov/vuln/detail/CVE-2010-5330","severity":null,"published_at":"2019-06-11T21:29:00+00:00","modified_at":"2026-06-16T23:26:34+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}