PT-2020-19999 · Ubiquiti · Airmax Airos

Published 2020-05-26 · Updated 2020-05-28 · CVE-2020-8171

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AirMax AirOS versions prior to 6.3.0

Description The issue concerns certain end-points that contain functionalities vulnerable to command injection, allowing for remote code execution by crafting an input string that bypasses filter checks.

Recommendations Update to the latest AirMax AirOS firmware version available at the AirMax download page.

Fix

Command Injection

OS Command Injection

Weakness Enumeration

CWE-77

CWE-78

Related Identifiers

CVE-2020-8171

Affected Products

Airmax Airos

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2020-8171 · Security Note
• https://community.ui.com/releases/Security-advisory-bulletin-011-011/d0d411a5-6dcb-4988-9709-d57f50957261 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8171 · Vendor Advisory
• https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83 · Vendor Advisory
• https://ui.com/download/airmax-m · Note