CVE-2010-5330: Ubiquiti AirOS Command Injection Vulnerability

CVE-2010-5330 is a command injection vulnerability in Ubiquiti AirOS that can be triggered by a crafted GET request to the stainfo.cgi endpoint on certain devices. An attacker who can reach that interface may cause the device to run unintended operating-system commands, which can lead to full device compromise, network pivoting, or disruption of wireless infrastructure that depends on AirOS.

Because AirOS commonly runs on outdoor wireless bridges, access points, and backhaul radios, a successful exploit can affect both the device itself and the segments it connects. Confirm exact product models and fixed releases against the vendor advisory before acting.

How it works

The weakness is classified as CWE-77 (Improper Neutralization of Special Elements used in a Command). In this class of flaw, user-controlled input that reaches a command interpreter is not properly sanitized or constrained. According to the public summary, the vulnerable path is a GET request to stainfo.cgi on certain Ubiquiti AirOS devices.

An attacker who can send HTTP requests to the management interface supplies input that the device incorporates into a shell command. If that input contains command separators or other special characters, the device may execute attacker-chosen commands with the privileges of the AirOS process. No further exploit mechanics are provided in the public record; treat any proof-of-concept details as unconfirmed until verified against the vendor advisory and your own lab testing.

Am I affected? How to find it in your systems

Ubiquiti AirOS typically runs on wireless radios, bridges, and access points used for point-to-point links, campus Wi-Fi, and ISP last-mile deployments. These devices are often reachable on management VLANs or, if misconfigured, on the public internet.

• Inventory all Ubiquiti wireless hardware and record the installed AirOS version from the device web UI, SSH/CLI, or central management console.
• Identify any device that exposes stainfo.cgi or the broader AirOS management web interface; confirm whether that interface is reachable from untrusted networks.
• Compare the discovered version and model against the vendor advisory for CVE-2010-5330; only the advisory lists the precise affected builds.
• Review web-server and firewall logs for unusual GET requests targeting stainfo.cgi, especially those containing shell metacharacters or unexpected parameter values.
• Watch for sudden configuration changes, unexpected outbound connections from the radio, or new administrative accounts that could indicate post-exploitation activity.

How to remediate

Patch first. Apply the updates supplied by Ubiquiti for the affected AirOS releases, following the vendor’s installation instructions exactly. CISA’s required action is to apply updates per vendor instructions; verify the fixed version string after the upgrade.

• Schedule a maintenance window that accounts for radio reboot and possible brief link interruption.
• After patching, re-check the AirOS version and confirm that stainfo.cgi no longer accepts the previously vulnerable input patterns (test only in a controlled environment).
• Harden remaining management access: restrict the web UI and SSH to dedicated management networks or jump hosts, disable unused services, and enforce strong authentication.
• Replace end-of-life hardware that can no longer receive AirOS security updates.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls appropriate to command-injection flaws on network appliances.

• Segment management interfaces onto isolated VLANs or out-of-band networks; block inbound access to the AirOS web port from untrusted zones at the firewall.
• If a web application firewall or reverse proxy sits in front of the device, consider virtual-patching rules that drop or sanitize requests to stainfo.cgi containing command metacharacters; validate any such rules carefully so legitimate monitoring is not broken.
• Disable the web management interface entirely if CLI or a central controller can perform the same administrative tasks.
• Increase monitoring: alert on any HTTP access to stainfo.cgi, on process-creation events if the platform supports them, and on unexpected configuration or firmware changes.
• Document the exception and set a firm deadline for completing the official patch.

If your data may have been exposed

Actively exploited vulnerabilities on network devices can lead to broader breaches, credential theft, or lateral movement. If you suspect compromise, isolate the affected radio, preserve logs, and begin incident-response procedures. You can also run a free exposure scan of your email addresses against known breach data sets to check whether associated accounts have appeared in prior incidents.