CVE-2010-5330
Ubiquiti AirOS Command Injection Vulnerability
Description
CVE-2010-5330 is a command injection vulnerability in Ubiquiti AirOS, the firmware powering Ubiquiti wireless networking devices. The flaw exists in the stainfo.cgi script, which fails to properly sanitize parameters passed via HTTP GET requests, allowing an unauthenticated remote attacker to inject and execute arbitrary operating system commands. CISA has added CVE-2010-5330 to the Known Exploited Vulnerabilities catalog, confirming active exploitation targeting Ubiquiti devices. With an EPSS score of 0.56% (98.1st percentile), this vulnerability represents a high-probability exploitation target, particularly concerning given the widespread deployment of Ubiquiti equipment in enterprise and service provider networks.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ui | airos | < 4.0.1; >= 4.0.2, < 5.3.5; >= 5.3.6, < 5.4.5 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974(Issue Tracking, Patch, Vendor Advisory)
- https://www.exploit-db.com/exploits/14146(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5330(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 describes a weakness where software constructs an operating system command using externally influenced input but does not properly neutralize special elements that could modify the intended command. In CVE-2010-5330, the stainfo.cgi script in Ubiquiti AirOS passes user-supplied GET parameters directly into shell commands without sanitization, enabling an attacker to append arbitrary commands using shell metacharacters.
Learn more: CWE-78 — Improper Neutralization of Special Elements used in an OS Command
Impact Analysis
CVE-2010-5330 grants unauthenticated remote attackers full command execution on Ubiquiti AirOS devices, allowing complete compromise of the device's confidentiality, integrity, and availability. Attackers can extract wireless credentials, network configurations, and authentication keys from the device, compromising the security of the entire wireless infrastructure. With command execution capability, adversaries can install persistent backdoors, modify routing tables, intercept network traffic, or use the compromised device as a pivot point for lateral movement into connected networks. The availability impact extends beyond the device itself — compromised Ubiquiti access points and bridges can disrupt connectivity for all dependent clients and downstream network segments.
Exploit Maturity
CVE-2010-5330 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active real-world exploitation against Ubiquiti AirOS devices. The EPSS score of 0.56% (98.1st percentile) indicates a very high exploitation probability, reflecting the simplicity of the attack (a single GET request) and the broad availability of exploit code. The Ubiquiti AirOS platform's widespread deployment in outdoor wireless networks and ISP infrastructure makes this vulnerability particularly attractive to botnet operators and network-level attackers.
Remediation
- Apply firmware updates immediately as required by CISA KEV: upgrade all Ubiquiti AirOS devices to the latest firmware version that addresses the command injection in stainfo.cgi.
- Restrict HTTP/HTTPS management access to Ubiquiti devices by binding management interfaces to dedicated VLAN segments and implementing ACLs that allow connections only from authorized management stations.
- Disable the HTTP management interface where possible and use SSH with key-based authentication for device administration.
- Audit all Ubiquiti AirOS devices for signs of compromise, including unexpected configuration changes, unauthorized user accounts, and unknown scheduled tasks or startup scripts.
- Implement network monitoring to detect exploitation attempts, specifically watching for HTTP GET requests to stainfo.cgi containing shell metacharacters or command injection patterns.
Technical Details
CVE-2010-5330 is a command injection vulnerability in the stainfo.cgi web interface script of Ubiquiti AirOS firmware. The script accepts parameters via HTTP GET requests and passes them unsanitized to an operating system shell command, likely through a system() or popen() call in the CGI handler. An attacker can inject shell metacharacters such as semicolons, pipes, or backticks to append arbitrary OS commands that execute with the privileges of the web server process, which typically runs as root on embedded Ubiquiti devices. The attack is completely unauthenticated and requires only HTTP access to the device's management interface, making it trivially exploitable by anyone who can reach the management port.
Frequently Asked Questions
Is CVE-2010-5330 being actively exploited?
Yes. CVE-2010-5330 is confirmed as actively exploited in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 0.56% (98.1st percentile) and the availability of public exploit code confirm high exploitation activity targeting Ubiquiti AirOS devices.
What products are affected by CVE-2010-5330?
CVE-2010-5330 affects Ubiquiti AirOS firmware, which runs on various Ubiquiti wireless networking products including airMAX and other outdoor wireless platforms. All AirOS versions with the vulnerable stainfo.cgi script are affected.
How do I fix CVE-2010-5330?
Update Ubiquiti AirOS firmware to the latest available version. Additionally, restrict management interface access to trusted networks only and consider disabling HTTP access in favor of SSH management.
How severe is CVE-2010-5330?
CVE-2010-5330 is a critical command injection vulnerability that grants unauthenticated remote attackers full command execution on Ubiquiti devices. Given these devices often serve as network infrastructure, compromise can affect entire network segments and all connected clients.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.