CVE-2010-5330

Name: CVE-2010-5330
Creator: NVD / NIST
Published: 2019-06-11T21:29:00.35+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

CRITICALCVSS 9.8/10Actively ExploitedEPSS 34.40%

Last modified Jun 16, 2026

CVE-2010-5330 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. CISA has confirmed active exploitation in the wild. EPSS estimates a 34.40% chance of exploitation in the next 30 days.

Description

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

Metrics

CVSS 3.1

9.8/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

34.40%

98.2th percentile

Probability of exploitation in the next 30 days. Learn more

Exploitation Status

This vulnerability is listed in CISA’s Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. Federal agencies must remediate by May 6, 2022.

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Ui	Airos	< 4.0.1
Ui	Airos	>= 4.0.2, < 5.3.5
Ui	Airos	>= 5.3.6, < 5.4.5

References

https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974Issue Tracking, Patch, Vendor Advisory
https://www.exploit-db.com/exploits/14146Third Party Advisory, VDB Entry
https://community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974Issue Tracking, Patch, Vendor Advisory
https://www.exploit-db.com/exploits/14146Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2010-5330US Government Resource

Timeline

Published: Jun 11, 2019
Last Modified: Jun 16, 2026
Status: Analyzed

Frequently Asked Questions

What is CVE-2010-5330?

How severe is CVE-2010-5330?

CVE-2010-5330 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 34.40% probability of exploitation in the next 30 days. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog.

How do I fix CVE-2010-5330?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2010-5330?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST