Ubiquiti Networks AirOS Remote Command Execution Vulnerability

Bugtraq ID:	51178
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 22 2011 12:00AM
Updated:	Mar 19 2015 08:47AM
Credit:	The vendor reported this issue.
Vulnerable:	Ubiquiti Networks, Inc. AirOS 5 Ubiquiti Networks, Inc. AirOS 4.0 Ubiquiti Networks, Inc. AirOS 3.6.1
Not Vulnerable:

Ubiquiti Networks AirOS Remote Command Execution Vulnerability

AirOS is prone to a vulnerability that lets attackers execute arbitrary commands in the context of the application. This issue occurs because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying device.

Ubiquiti Networks AirOS Remote Command Execution Vulnerability

Attackers can exploit this issue with a browser.

The following example URI is available:

http://www.example.com/admin.cgi/sd.css

Reports indicate this issue is actively being exploited by a worm.

Ubiquiti Networks AirOS Remote Command Execution Vulnerability

Solution:
Updates are available. Please see the references for more details.

Ubiquiti Networks AirOS Remote Command Execution Vulnerability

References:

• AirOS remote root 0day (sd)
  
• Vendor Homepage (Ubiquiti Networks, Inc.)
  
• Vulnerabilidade de AirOS (Ubiquiti Networks)