CVE-2015-9266
Description
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. An attacker can exploit this vulnerability to gain root privileges. This vulnerability is fixed in the following product versions (fixes released in July 2015, all prior versions are affected): airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; and EdgeSwitch XP (formerly TOUGHSwitch) 1.3.2.
How to fix
- ui airmax_m_xm_firmware5.6.2 or later
- ui airmax_m_xw_firmware5.6.2 or later
- ui airmax_m_ti_firmware5.6.2 or later
- ui airgateway_firmware1.15 or later
- ui airfiber_af24_firmware2.2.1 or later
- ui airfiber_af24hd_firmware2.2.1 or later
- ui af5x_firmware3.0.2.1 or later
- ui af5_firmware2.2.1 or later
- ubnt airos_4_xs24.0.4 or later
- ubnt airos_4_xs54.0.4 or later
- ubnt edgeswitch_xp_firmware1.3.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ui airmax_ac_firmware | 7.1.3 | — |
| ui airmax_m_xm_firmware | v < 5.6.2 | 5.6.2 |
| ui airmax_m_xw_firmware | v < 5.6.2 | 5.6.2 |
| ui airmax_m_ti_firmware | v < 5.6.2 | 5.6.2 |
| ui airgateway_firmware | v < 1.15 | 1.15 |
| ui airfiber_af24_firmware | v < 2.2.1 | 2.2.1 |
| ui airfiber_af24hd_firmware | v < 2.2.1 | 2.2.1 |
| ui af5x_firmware | v < 3.0.2.1 | 3.0.2.1 |
| ui af5_firmware | v < 2.2.1 | 2.2.1 |
| ubnt airos_4_xs2 | v < 4.0.4 | 4.0.4 |
| ubnt airos_4_xs5 | v < 4.0.4 | 4.0.4 |
| ubnt edgeswitch_xp_firmware | v < 1.3.2 | 1.3.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.