Ubiquiti airOS HTTP(S) unauthenticated arbitrary file upload

published 2018-09-05 8 y ago modified 2026-06-17 4 mo ago also EUVD-2015-9108

cvss: 9.8; version 3.0, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 74.0%; EPSS 74.0% chance of exploitation in 30 days, percentile 99.4%
public exploits: 2; Metasploit, Exploit-DB

The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.

Patch / fix

fixed in 11 links 1

ui airmax_m_xm_firmware 5.6.2
ui airmax_m_xw_firmware 5.6.2
ui airmax_m_ti_firmware 5.6.2
ui airgateway_firmware 1.15
ui airfiber_af24_firmware 2.2.1
ui airfiber_af24hd_firmware 2.2.1
ui af5x_firmware 3.0.2.1
ui af5_firmware 2.2.1
ubnt airos_4_xs2 4.0.4
ubnt airos_4_xs5 4.0.4
ubnt edgeswitch_xp_firmware 1.3.2

community.ubnt.com/t5/airMAX-Updates-Blog/Security-Release-for-airMAX-TOUGHSw… advisory

Timeline

2016-02-13 First public exploit (Metasploit exploit/linux/http/ubiquiti_airos_file_upload)
2018-09-05 Published

Exploit prediction

74.00% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

Metasploit exploit/linux/http/ubiquiti_airos_file_upload Ubiquiti airOS Arbitrary File Upload metasploit exploit, excellent rank, 2016-02-13
EDB-39701 AirOS 6.x - Arbitrary File Upload webapps, 2016-04-15
exploit-db.com https://www.exploit-db.com/exploits/39853/ referenced PoC, tagged "exploit" by a source, unverified
rapid7.com https://www.rapid7.com/db/modules/exploit/linux/ssh/ubiquiti_airos_file_upload referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	3.0	9.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-22 Improper Limitation of a Pathname to a Restricted Directory

References

community.ubnt.com /t5/airMAX-Updates-Blog/Security-Release-for-airMAX-TOUGHSwitch-and-airGateway-Released/ba-p/1300494
patch, vendor-advisory
exploit-db.com /exploits/39701/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/39853/
exploit, third-party-advisory, vdb-entry
rapid7.com /db/modules/exploit/linux/ssh/ubiquiti_airos_file_upload
exploit, third-party-advisory
community.ubnt.com /t5/airMAX-Updates-Blog/Important-Security-Notice-and-airOS-5-6-5-Release/ba-p/1565949
vendor-advisory
community.ubnt.com /t5/airMAX-General-Discussion/Virus-attack-URGENT-UBNT/td-p/1562940
vendor-advisory
hackerone.com /reports/73480
issue-tracking, third-party-advisory

Sources

CVE List CVE-2015-9266
NVD CVE-2015-9266

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary