vendor:
AirOS
by:
xistence
7,5
CVSS
HIGH
Remote Command Execution
78
CWE
Product Name: AirOS
Affected Version From: 5.5.2 and lower
Affected Version To: 5.5.2 and lower
Patch Exists: YES
Related CWE: N/A
CPE: a:ubiquiti_networks:airos:5.5.2
Metasploit:
N/A
Other Scripts:
N/A
Tags: N/A
CVSS Metrics: N/A
Nuclei References:
N/A
Nuclei Metadata: N/A
Platforms Tested: PicoStation M2 (hardware)
2012
Ubiquiti AirOS <= 5.5.2 Remote POST-Auth Root Command Execution
The http://<IP>/test.cgi 'essid' parameter is not sanitized for input which allows for execution of operating system commands. The parameter input field can be like this to create a file /tmp/test.txt: 'LINKTEST & /bin/touch /tmp/test.txt #'. Authentication to the web site is necessary to exploit this vulnerability.
Mitigation:
Sanitize user input for the 'essid' parameter.
