CVE-2015-9266 Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload
Unauthenticated attackers can upload arbitrary files via directory traversal in Ubiquiti network devices, leading to root privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2015-9266?
CVE-2015-9266 is a critical path traversal vulnerability in n/a, published on 5 Sep 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
Weakness: CWE-22
Which versions are affected by CVE-2015-9266?
It affects 12 products.
Products include Ubnt Airos 4 Xs2, Ubnt Airos 4 Xs5, Ubnt Edgeswitch Xp Firmware, Ui Af5 Firmware, Ui Af5x Firmware, Ui Airfiber Af24 Firmware and 6 more.
How do I fix CVE-2015-9266?
No fix has been published for CVE-2015-9266 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2015-9266 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-9266 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Sources
Also known as GHSA-8gj2-cpjj-73rf.