CVE-2010-5330VulnerabilityPublished 04/15/2022Updated 10/24/2026

CVE-2010-5330: Ubiquiti AirOS Command Injection Vulnerability

Affects Ubiquiti AirOSSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 04/15/2022
KEV deadline: 05/06/2022
EPSS: 40.2% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2010-5330 (opens in a new tab)

Description

Certain Ubiquiti AirOS devices are affected by a command injection vulnerability via a GET request to stainfo.cgi. This vulnerability allows an attacker to execute arbitrary commands on the affected device. It has been exploited in the wild, indicating active threat usage. No specific affected versions or patch information are provided.

Summary

CVE-2010-5330 describes a command injection vulnerability in Ubiquiti AirOS devices. The flaw exists in the handling of GET requests to the stainfo.cgi endpoint, allowing remote attackers to execute arbitrary commands. The vulnerability is known to be exploited in the wild, increasing its risk profile. No vendor advisory or patch information is available in the provided data.

Impact

Successful exploitation allows remote command execution on affected Ubiquiti AirOS devices, potentially leading to full device compromise. Given the known exploitation in the wild, this vulnerability poses a high risk to affected systems.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected device interfaces and monitor for suspicious activity related to stainfo.cgi requests.

Weaknesses

CWE-77Command Injection (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 11:26:48 UTC

Weaknesses

References

Related threats