Vulnerability Description
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ui | Airmax Ac Firmware | 7.1.3 |
| Ui | Airmax Ac | - |
| Ui | Airmax M Xm Firmware | < 5.6.2 |
| Ui | Airmax M Xm | - |
| Ui | Airmax M Xw Firmware | < 5.6.2 |
| Ui | Airmax M Xw | - |
| Ui | Airmax M Ti Firmware | < 5.6.2 |
| Ui | Airmax M Ti | - |
| Ui | Airgateway Firmware | < 1.15 |
| Ui | Airgateway | - |
| Ui | Airfiber Af24 Firmware | < 2.2.1 |
| Ui | Airfiber Af24 | - |
| Ui | Airfiber Af24Hd Firmware | < 2.2.1 |
| Ui | Airfiber Af24Hd | - |
| Ui | Af5X Firmware | < 3.0.2.1 |
| Ui | Af5X | - |
| Ui | Af5 Firmware | < 2.2.1 |
| Ui | Af5 | - |
| Ubnt | Airos 4 Xs2 | < 4.0.4 |
| Ubnt | Airos 4 Xs5 | < 4.0.4 |
Related Weaknesses (CWE)
References
- https://community.ubnt.com/t5/airMAX-General-Discussion/Virus-attack-URGENT-UBNTVendor Advisory
- https://community.ubnt.com/t5/airMAX-Updates-Blog/Important-Security-Notice-and-Vendor Advisory
- https://community.ubnt.com/t5/airMAX-Updates-Blog/Security-Release-for-airMAX-TOPatchVendor Advisory
- https://hackerone.com/reports/73480Issue TrackingThird Party Advisory
- https://www.exploit-db.com/exploits/39701/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/39853/ExploitThird Party AdvisoryVDB Entry
- https://www.rapid7.com/db/modules/exploit/linux/ssh/ubiquiti_airos_file_uploadExploitThird Party Advisory
- https://community.ubnt.com/t5/airMAX-General-Discussion/Virus-attack-URGENT-UBNTVendor Advisory
- https://community.ubnt.com/t5/airMAX-Updates-Blog/Important-Security-Notice-and-Vendor Advisory
- https://community.ubnt.com/t5/airMAX-Updates-Blog/Security-Release-for-airMAX-TOPatchVendor Advisory
- https://hackerone.com/reports/73480Issue TrackingThird Party Advisory
- https://www.exploit-db.com/exploits/39701/ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/39853/ExploitThird Party AdvisoryVDB Entry
- https://www.rapid7.com/db/modules/exploit/linux/ssh/ubiquiti_airos_file_uploadExploitThird Party Advisory
FAQ
What is CVE-2015-9266?
CVE-2015-9266 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory tr...
How severe is CVE-2015-9266?
CVE-2015-9266 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2015-9266?
Check the references section above for vendor advisories and patch information. Affected products include: Ui Airmax Ac Firmware, Ui Airmax Ac, Ui Airmax M Xm Firmware, Ui Airmax M Xm, Ui Airmax M Xw Firmware.