CVE-2020-8171 : We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW

We have recently released new version of AirMax AirOS firmware v6.3.0 for TI, XW and XM boards that fixes vulnerabilities found on AirMax AirOS v6.2.0 and prior TI, XW and XM boards, according to the description below:There are certain end-points containing functionalities that are vulnerable to command injection. It is possible to craft an input string that passes the filter check but still contains commands, resulting in remote code execution.Mitigation:Update to the latest AirMax AirOS firmware version available at the AirMax download page.

Published 2020-05-26 16:15:13

Updated 2020-05-28 20:00:04

Source HackerOne

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2020-8171

UI » Airos
Versions up to, including, (<=) 6.2.0
cpe:2.3:o:ui:airos:*:*:*:*:*:*:*:*
Matching versions
When used together with: UI » Ag-hp-2g16 » Version: N/A
When used together with: UI » Ag-hp-2g20 » Version: N/A
When used together with: UI » Ag-hp-5g23 » Version: N/A
When used together with: UI » Ag-hp-5g27 » Version: N/A
When used together with: UI » Airgrid M » Version: N/A
When used together with: UI » Airgrid M2 » Version: N/A
When used together with: UI » Airgrid M5 » Version: N/A
When used together with: UI » AR » Version: N/A
When used together with: UI » Ar-hp » Version: N/A
When used together with: UI » Bm2-ti » Version: N/A
When used together with: UI » Bm2hp » Version: N/A
When used together with: UI » Bm5-ti » Version: N/A
When used together with: UI » Bm5hp » Version: N/A
When used together with: UI » Is-m5 » Version: N/A
When used together with: UI » Lbem5-23 » Version: N/A
When used together with: UI » Litestation M5 » Version: N/A
When used together with: UI » Locom2 » Version: N/A
When used together with: UI » Locom5 » Version: N/A
When used together with: UI » Locom9 » Version: N/A
When used together with: UI » M2 » Version: N/A
When used together with: UI » M3 » Version: N/A
When used together with: UI » M365 » Version: N/A
When used together with: UI » M5 » Version: N/A
When used together with: UI » M900 » Version: N/A
When used together with: UI » Nb-2g18 » Version: N/A
When used together with: UI » Nb-5g22 » Version: N/A
When used together with: UI » Nb-5g25 » Version: N/A
When used together with: UI » Nbe-m2-13 » Version: N/A
When used together with: UI » Nbe-m5-16 » Version: N/A
When used together with: UI » Nbe-m5-19 » Version: N/A
When used together with: UI » Nbm3 » Version: N/A
When used together with: UI » Nbm365 » Version: N/A
When used together with: UI » Nbm9 » Version: N/A
When used together with: UI » Nsm2 » Version: N/A
When used together with: UI » Nsm3 » Version: N/A
When used together with: UI » Nsm365 » Version: N/A
When used together with: UI » Nsm5 » Version: N/A
When used together with: UI » Pbe-m2-400 » Version: N/A
When used together with: UI » Pbe-m5-300 » Version: N/A
When used together with: UI » Pbe-m5-300-iso » Version: N/A
When used together with: UI » Pbe-m5-400 » Version: N/A
When used together with: UI » Pbe-m5-400-iso » Version: N/A
When used together with: UI » Pbe-m5-620 » Version: N/A
When used together with: UI » Pbm10 » Version: N/A
When used together with: UI » Pbm365 » Version: N/A
When used together with: UI » Pbm5 » Version: N/A
When used together with: UI » Picom2hp » Version: N/A
When used together with: UI » Power Ap N » Version: N/A
When used together with: UI » Rm2-ti » Version: N/A
When used together with: UI » Rm5-ti » Version: N/A

Exploit prediction scoring system (EPSS) score for CVE-2020-8171

EPSS FAQ

4.57%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 92 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2020-8171

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P	10.0	6.4	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	3.9	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

CWE ids for CVE-2020-8171

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Assigned by: support@hackerone.com (Secondary)
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2020-8171

https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83

v6.3.0 | Ubiquiti Community
Vendor Advisory

CVEs referencing this url
https://www.ui.com/download/airmax-m

Ubiquiti - Downloads
Release Notes

CVEs referencing this url
https://community.ui.com/releases/Security-advisory-bulletin-011-011/d0d411a5-6dcb-4988-9709-d57f50957261

Security advisory bulletin 011 | Ubiquiti Community
Vendor Advisory

Jump to

Vulnerability Details : CVE-2020-8171

Products affected by CVE-2020-8171

Exploit prediction scoring system (EPSS) score for CVE-2020-8171

CVSS scores for CVE-2020-8171

CWE ids for CVE-2020-8171

References for CVE-2020-8171