CVE-2015-9266
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary files via directory traversal in Ubiquiti network devices' web management interface. Attackers can exploit this to gain root privileges on affected devices. All Ubiquiti airMAX, airFiber, airGateway, and EdgeSwitch XP devices running versions prior to July 2015 security updates are affected.
💻 Affected Systems
- Ubiquiti airMAX
- Ubiquiti airFiber
- Ubiquiti airGateway
- Ubiquiti EdgeSwitch XP (formerly TOUGHSwitch)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise with root access, allowing attackers to install persistent backdoors, intercept network traffic, pivot to internal networks, or use devices for botnet participation.
Likely Case
Remote code execution leading to device takeover, configuration modification, credential theft, and network disruption.
If Mitigated
Limited impact if devices are behind firewalls with restricted web interface access and proper network segmentation.
🎯 Exploit Status
Exploit code is publicly available on Exploit-DB and HackerOne. Simple HTTP requests with directory traversal payloads can achieve root access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: airMAX AC 7.1.3; airMAX M (and airRouter) 5.6.2 XM/XW/TI, 5.5.11 XM/TI, and 5.5.10u2 XW; airGateway 1.1.5; airFiber AF24/AF24HD 2.2.1, AF5x 3.0.2.1, and AF5 2.2.1; airOS 4 XS2/XS5 4.0.4; EdgeSwitch XP 1.3.2
Vendor Advisory: https://community.ubnt.com/t5/airMAX-Updates-Blog/Important-Security-Notice-and-airOS-5-6-5-Release/ba-p/1565949
Restart Required: Yes
Instructions:
1. Log into device web interface. 2. Navigate to System > Upgrade. 3. Download appropriate firmware version from Ubiquiti downloads page. 4. Upload and apply firmware update. 5. Device will reboot automatically.
🔧 Temporary Workarounds
Disable Web Management Interface
allDisable the vulnerable web interface and use alternative management methods
Use SSH/CLI to disable web interface: configure -> set service gui disable -> commit
Restrict Web Interface Access
linuxLimit access to web interface using firewall rules
iptables -A INPUT -p tcp --dport 80 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
🧯 If You Can't Patch
- Place devices behind firewalls with strict inbound rules blocking all access to web management ports (80, 443, 8080)
- Segment affected devices on isolated VLANs to prevent lateral movement if compromised
🔍 How to Verify
Check if Vulnerable:
Check current firmware version via web interface (System > Status) or SSH (show version). Compare with patched versions listed in advisory.Check Version:
ssh admin@device_ip 'show version' or check web interface at System > StatusVerify Fix Applied:
Confirm firmware version matches or exceeds patched versions. Test web interface with directory traversal attempts (../) in file upload parameters.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences in file upload parameters
- Unauthenticated file upload attempts to web interface
- Unexpected file creation in system directories
Network Indicators:
- HTTP POST requests to /upload.cgi or similar endpoints with traversal sequences
- Unusual outbound connections from network devices
SIEM Query:
source="ubiquiti_logs" AND (http_uri="*../*" OR http_post_data="*../*")🔗 References
- https://community.ubnt.com/t5/airMAX-General-Discussion/Virus-attack-URGENT-UBNT/td-p/1562940
- https://community.ubnt.com/t5/airMAX-Updates-Blog/Important-Security-Notice-and-airOS-5-6-5-Release/ba-p/1565949
- https://community.ubnt.com/t5/airMAX-Updates-Blog/Security-Release-for-airMAX-TOUGHSwitch-and-airGateway-Released/ba-p/1300494
- https://hackerone.com/reports/73480
- https://www.exploit-db.com/exploits/39701/
- https://www.exploit-db.com/exploits/39853/
- https://www.rapid7.com/db/modules/exploit/linux/ssh/ubiquiti_airos_file_upload
- https://community.ubnt.com/t5/airMAX-General-Discussion/Virus-attack-URGENT-UBNT/td-p/1562940
- https://community.ubnt.com/t5/airMAX-Updates-Blog/Important-Security-Notice-and-airOS-5-6-5-Release/ba-p/1565949
- https://community.ubnt.com/t5/airMAX-Updates-Blog/Security-Release-for-airMAX-TOUGHSwitch-and-airGateway-Released/ba-p/1300494
- https://hackerone.com/reports/73480
- https://www.exploit-db.com/exploits/39701/
- https://www.exploit-db.com/exploits/39853/
- https://www.rapid7.com/db/modules/exploit/linux/ssh/ubiquiti_airos_file_upload
