---
id: "CVE-2010-5330"
kind: "vulnerability"
aliases: ["CVE-2010-5330"]
title: "Ubiquiti AirOS: Ubiquiti AirOS Command Injection Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.40232
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Ubiquiti AirOS", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["airos", "exploited", "infrastructure", "self-hosted", "ubiquiti"]
not_affected_if: ["unknown"]
published_at: "2019-06-11T21:29:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-5330", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2010-5330", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-5330", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Ubiquiti AirOS: Ubiquiti AirOS Command Injection Vulnerability

Certain Ubiquiti AirOS devices accept a crafted GET request to stainfo.cgi that injects operating system commands. An unauthenticated attacker who can reach the device can run commands on it.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Ubiquiti AirOS affected ? fixed ?

## Fix

Apply the updates per vendor instructions (CISA KEV required action); the affected and fixed versions are not stated in the sources.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2010-5330
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2010-5330
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2010-5330

## From the sources

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_