긴급도 80/100 심각도 9.8 · 치명적 악용확률 98.6% CISA KEV · 2022-04-15 CWE-77

CVE-2010-5330

CISA 기관 조치 기한: 2022-05-06

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

KEV 필수 조치: Apply updates per vendor instructions.

타임라인

2019-06-11 NVD 공개
2022-04-15 CISA KEV 등재(실제 악용 확인) 공개 후 1,039일
2022-05-06 CISA 기관 조치 기한 경과

벡터: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD 상세 ↗ 벤더 권고문 ↗ 참고 링크 ↗