CVE-2010-5330 is a command injection vulnerability in Ubiquiti AirOS. CISA added it to the Known Exploited Vulnerabilities catalogue on 15 April 2022, which means attackers have used it in real attacks. Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Why this vulnerability matters
Command injection is dangerous because the application passes attacker-controlled input into a system command, so a simple web request can become operating-system level execution. On exposed network devices, that can turn a management feature into an entry point for device takeover, configuration tampering, traffic interception, or pivoting inside the environment.
For CVE records and exploit status, use the official CVE Program entry and the NIST National Vulnerability Database. Those sources are where version details, references, and remediation metadata are maintained.
How organisations check exposure
Exposure review starts with an accurate inventory of Ubiquiti devices and the management interfaces they expose. If the vulnerable interface is reachable from the internet or from broadly trusted internal networks, the practical attack surface is much larger than the product name alone suggests.
Teams should confirm whether the affected devices are present, whether management endpoints are externally accessible, and whether vendor advisories or upstream notices mention the specific request path involved. That triage is more reliable than assuming a device is safe because it sits behind a firewall or is used only for networking.
The broader vulnerability workflow is well captured in NHIMG’s Vulnerability Management Guide, which is useful for prioritising KEV-listed issues and verifying remediation after action is taken.
Remediation and compensating controls
The preferred fix is the vendor-provided patch or firmware update for the exact device and release in question. Until that can be applied, reduce reachability, restrict administrative access to trusted management networks, and remove unnecessary exposure of the web interface.
Compensating controls matter because command injection often requires only one successful request. Network segmentation, tight allowlists, and strong administrative access boundaries can reduce the chance that a vulnerable device is reachable by an attacker during the remediation window.
NHIMG’s Web Application Attacks Guide is a useful companion for understanding why command injection is so exploitable and why request filtering alone is not a durable control.
Detection and compromise review
After patching or containment, review the device for signs that the vulnerability was already used. That includes unexpected configuration changes, unusual admin activity, new accounts or credentials, altered services, and any evidence that the device was used as a foothold for adjacent network access.
Because command injection can execute arbitrary operating-system commands, compromise review should also consider whether logs, local files, scheduled tasks, or outbound connections indicate post-exploitation activity. If a management credential or session was exposed during the incident, rotate it and review other systems that may have shared trust with the device.
NHIMG’s The State of NHI & AI Agent Breach Report 2026 provides a broader incident lens on how compromised credentials and trusted access paths are commonly abused after initial compromise.
Risk and Threat Considerations
Command injection on a network device is especially risky because the management plane often has broad trust and high privilege. Once exploited, an attacker may be able to change settings, intercept traffic, or use the device as a stepping stone into other systems that implicitly trust it.
Failure mechanism: The vulnerable CGI endpoint accepts crafted input that reaches a shell command, so attacker-controlled parameters can be executed instead of treated as data.
Impact: Successful exploitation can lead to remote code execution, device compromise, service disruption, and secondary access into the network that the device protects or manages.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 addresses the attack and risk surface, while OWASP ASVS, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V15 — Secure Coding and Architecture | Command injection is an input-to-execution design failure addressed by secure architecture controls. |
| Recommendation — Remove shell execution paths from request handling and enforce secure command construction. | ||
| OWASP API Security Top 10 | API8 — Security Misconfiguration | A vulnerable management endpoint exposed through web requests reflects insecure service configuration. |
| Recommendation — Restrict management interfaces and harden request handling on exposed device endpoints. | ||
| CIS Controls v8 | CIS-7 — Continuous Vulnerability Management | This KEV-listed flaw requires asset discovery, prioritisation, and remediation tracking. |
| Recommendation — Prioritise and remediate the affected devices using continuous vulnerability management. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Command injection results from failing to validate untrusted input before command execution. |
| RA-5 — Vulnerability Monitoring and Scanning | Exposure assessment depends on identifying vulnerable devices and confirming whether they remain reachable. | |
| Recommendation — Validate and sanitise all request parameters before they reach system commands. Scan, inventory, and track vulnerable devices until exposure is eliminated. | ||
Practitioner Guidance
Why practitioners should care: Treat any externally reachable management interface as a high-value target, especially when it sits on infrastructure that mediates traffic, authentication, or administrative control. A small web flaw on a device with broad network trust can have outsized operational impact.
What to watch for: Prioritise rapid exposure assessment, patching, and post-patch compromise review on devices that are internet-facing, remotely administered, or embedded in critical network paths. If you cannot patch immediately, minimise reachability first, then verify that no attacker activity occurred during the exposure window.
Practitioner takeaway: For device vulnerabilities like this one, remediation is not complete until exposure is reduced and the device has been checked for signs of prior abuse.