High‑Severity Command Injection in Ubiquiti AirOS (CVE‑2010‑5330) Threatens Network Device Management

High‑Severity Command Injection in Ubiquiti AirOS (CVE‑2010‑5330) Threatens Network Device Management

What It Is

A command‑injection flaw exists in the stainfo.cgi endpoint of Ubiquiti AirOS firmware. An attacker can embed arbitrary OS commands in an unauthenticated HTTP GET request, causing the device to execute them with the privileges of the AirOS process.

Exploitability

The vulnerability is rated High (CVSS v3.1 ≈ 7.5). Public proof‑of‑concept scripts are available, and the issue is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating confirmed exploitation in the wild. No vendor‑issued patch has been released for all affected firmware versions yet.

Affected Products

Ubiquiti AirOS‑based wireless devices (e.g., NanoStation, LiteBeam, Rocket, and other AirMax product lines) that expose the web management interface to untrusted networks.

Why It Matters for Compliance & Audit Readiness

Vendor‑management controls: Continuous monitoring of third‑party hardware is a core control in most governance frameworks (e.g., NIST CSF ID.AM‑1, ISO 27001 A.15). An unpatched command‑injection flaw demonstrates a lapse in the vendor‑risk lifecycle—specifically, the failure to verify that critical firmware updates are applied in a timely manner.

Audit evidence: Documenting device inventories, firmware versions, and remediation steps creates a defensible audit trail that satisfies “due diligence” expectations under regulations such as GDPR, HIPAA, and PCI‑DSS.

Control assurance: Remediating this flaw directly strengthens the “protect” function of the NIST CSF by restoring the integrity of network‑device management controls.

Recommended Actions

• Inventory all Ubiquiti AirOS devices and record firmware release numbers.
• Patch/Upgrade to the latest firmware that addresses CVE‑2010‑5330; if none is available, apply vendor‑issued mitigations (e.g., disable the web UI or restrict it to trusted LAN segments).
• Network‑segment management interfaces and enforce firewall rules that block inbound traffic to stainfo.cgi from untrusted sources.
• Monitor web server logs for anomalous GET requests to /stainfo.cgi and generate alerts for any command‑injection patterns.
• Update vendor‑risk documentation to reflect the new finding, capture remediation evidence, and schedule periodic verification.
• Validate that any compensating controls (e.g., IDS signatures) are active and tuned.

Source: https://nvd.nist.gov/vuln/detail/CVE-2010-5330