Critical severity9.8CISA KEVNVD Advisory· Published Jun 11, 2019· Updated Jun 16, 2026

CVE-2010-5330

Description

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

UI/Airos
cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:*
Range: <4.0.1
Ubiquiti/802.11 ISP productsdescription
Ubiquiti Inc/802.11 ISP productsllm-create
Range: v4.0.1
Ubiquiti Inc/AirMax ISP productsllm-create
Range: v5.3.5
Ubiquiti Inc/AirSync firmwarellm-create
Range: v5.4.5
Ubiquiti Inc/Nanostation5llm-create
Range: Air OS

Patches

Vulnerability mechanics

References

community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974nvdIssue TrackingPatchVendor Advisory
www.exploit-db.com/exploits/14146nvdThird Party AdvisoryVDB Entry
www.cisa.gov/known-exploited-vulnerabilities-catalognvdUS Government Resource

News mentions

Ubiquiti warns of new max severity UniFi OS vulnerability
BleepingComputer · Jul 8, 2026
Ubiquiti patches three max severity UniFi OS vulnerabilities
BleepingComputer · May 22, 2026

cvss	0.637
epss	0.028
exploit	0.000
kev	0.120
patch	0.000
ransomware	0.000