Unrated severityCISA KEVNVD Advisory· Published Jun 11, 2019· Updated Oct 21, 2025
CVE-2010-5330
CVE-2010-5330
Description
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Ubiquiti/802.11 ISP productsdescription
- Range: <=4.0.0 (802.11 ISP), <=5.3.4 (AirMax), <=5.4.4 (AirSync)
Patches
Vulnerability mechanics
References
2- community.ubnt.com/t5/airMAX-General-Discussion/AirOS-Security-Exploit-Updated-Firmware/td-p/212974mitrex_refsource_MISC
- www.exploit-db.com/exploits/14146mitrex_refsource_MISC
News mentions
1- Ubiquiti patches three max severity UniFi OS vulnerabilitiesBleepingComputer · May 22, 2026