Ubiquiti AirOS stainfo.cgi Remote Command Injection Vulnerability (CVE-2010-5330) Analysis & Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTUbiquiti AirOS prior to v4.0.1 (802.11 ISP), v5.3.5 (AirMax), v5.4.5 (AirSync), and Nanostation5 devices
Unauthenticated remote attackers can execute arbitrary system commands with root privileges via a specially crafted HTTP GET request
Immediately upgrade to the patched firmware versions and restrict external access to the web management interface
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official firmware updates provided by the vendor. You can download and apply the firmware via SSH using the following commands:
# 1. Access the device via SSH and navigate to the temporary directory
cd /tmp
# 2. Download the patched firmware (ensure the URL matches your specific hardware model)
wget http://dl.ubnt.com/firmwares/XS-fw/v4.0.1/XS2.ar2316.v4.0.1.4978.111220.1641.bin
# 3. Execute the firmware update command
fwupdate -m -f XS2.ar2316.v4.0.1.4978.111220.1641.bin2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the web management interface (ports 80 and 443) using firewall rules to allow only trusted administrator IPs.
# Block all external access to web management ports
iptables -A INPUT -p tcp -m multiport --dports 80,443 -j DROP
# Allow access only from a trusted management IP (e.g., 192.168.1.100)
iptables -I INPUT 1 -p tcp -s 192.168.1.100 -m multiport --dports 80,443 -j ACCEPT3. Log Audit & IoC Verification Commands
Inspect the web server access logs for suspicious requests targeting stainfo.cgi containing shell metacharacters.
# Scan web access logs for stainfo.cgi requests containing shell metacharacters
grep -E 'stainfo\.cgi.*(;|%3B|\||%7C|&|%26|`|%60)' /var/log/lighttpd/access.log
# Verify the current running AirOS version
cat /etc/versionStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2010-5330) exists in the stainfo.cgi (Show AP info) script of the Ubiquiti AirOS web management interface. The root cause is the lack of proper input sanitization on the ifname parameter before passing it to system shell execution functions. This allows remote attackers to inject shell metacharacters (such as ;, &, or |) to execute arbitrary commands under the context of the web server (typically root).
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker sends a crafted HTTP GET request targeting stainfo.cgi with malicious payloads in the ifname parameter. For example, a request like http://<target-ip>/stainfo.cgi?ifname=ath0;[attacker_command] forces the underlying operating system to execute the command appended after the semicolon. Because this vulnerability is listed in the CISA KEV catalog, it has been actively exploited in the wild by threat actors targeting edge networking equipment.
3. Infrastructure & Business Impact
Since these devices are widely deployed in Wireless ISP (WISP) infrastructures and backhaul networks, compromise of a device can lead to full network takeover. Attackers can intercept network traffic, perform Man-in-the-Middle (MitM) attacks by altering DNS settings, or use the compromised device as a pivot point to breach internal private networks.
Official Vendor Advisories & References
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
Frequently Asked SecOps Questions (CVE-2010-5330)
FAQQ1. How critical is CVE-2010-5330 and is it actively exploited in the wild?
CVE-2010-5330 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 40.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2010-5330?
Primary impacted vendors include ubiquiti across airos, nanostation5, airmax, airsync. Scope summary: Ubiquiti AirOS-based devices (including Nanostation5) - 802.11 ISP products: Versions prior to v4.0.1 - AirMax ISP products: Versions prior to v5.3.5 - AirSync firmware: Versions prior to v5.4.5
Q3. What temporary mitigations or workarounds exist for CVE-2010-5330 before patching?
[Mitigation] Immediately upgrade to the patched firmware versions and restrict external access to the web management interface Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2010-5330
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ubiquiti)
View Category →Ubiquiti UniFi OS Remote Command Injection Vulnerability (CVE-2026-34910) Security Advisory
[Affected Scope] All network-accessible Ubiquiti UniFi OS devices
Ubiquiti UniFi OS Path Traversal and Remote Code Execution Vulnerability (CVE-2026-34909)
[Affected Scope] All Ubiquiti UniFi OS devices accessible via the network.
Ubiquiti UniFi OS Improper Access Control Vulnerability (CVE-2026-34908) - Remote Code Execution and System Takeover Risk
[Affected Scope] Ubiquiti UniFi OS devices accessible via the network
Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)
[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.