Critical · published June 11, 2019
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 98.6th percentile for exploit probability.
🚨 A crafty GET request can unleash chaos on Ubiquiti devices! This command injection flaw in stainfo.cgi allows attackers to execute arbitrary commands—think of it as a burglar slipping a not-so-friendly note under the door of your network. 🔥 Imagine your Wi-Fi router like a restaurant kitchen. If the chef trusts any order without verifying the ingredients, a prankster could request something ridiculous like a chocolate-covered pizza! In this case, the ifname variable is that unguarded kitchen order, letting attackers mix in malicious commands. This is absolutely devastating! An attacker could exploit this vulnerability to execute any command on the device, potentially taking control of your entire network. This means they could snoop on traffic, change configurations, or even disrupt services—leaving your network wide open to exploitation.
Imagine your Wi-Fi router like a restaurant kitchen. If the chef trusts any order without verifying the ingredients, a prankster could request something ridiculous like a chocolate-covered pizza! In this case, the ifname variable is that unguarded kitchen order, letting attackers mix in malicious commands. The command injection vulnerability occurs via a GET request to stainfo.cgi, where the ifname variable isn't properly sanitized. This allows attackers to inject shell metacharacters and gain unauthorized access to the device's command line.
This is absolutely devastating! An attacker could exploit this vulnerability to execute any command on the device, potentially taking control of your entire network. This means they could snoop on traffic, change configurations, or even disrupt services—leaving your network wide open to exploitation. Patch immediately to version 4.0.1 for 802.11 ISP products, 5.3.5 for AirMax ISP products, or 5.4.5 for AirSync firmware. Ensure that all configurations are reviewed and hardened against unauthorized requests. Regularly audit your Ubiquiti devices to detect any signs of compromise. You've got this! Secure your network with these updates and keep those cyber villains at bay! 🛡️