Cyber Posture

CVE-2020-37052

CriticalPublic PoC

Published: 30 January 2026

Published
30 January 2026
Modified
15 April 2026
KEV Added
Patch
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0026 49.1th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection. Attackers can exploit the /.seam endpoint by crafting a specially constructed URL with embedded Java expressions to…

more

run commands with the application's system privileges.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly mitigates CVE-2020-37052 by requiring timely identification, reporting, testing, and patching of the pre-authentication Java expression injection flaw in AirControl.

prevent

Prevents exploitation of the code injection vulnerability by validating URL inputs to the /.seam endpoint against malicious Java expressions.

prevent

Limits remote unauthenticated access to the vulnerable AirControl application and /.seam endpoint through boundary protection mechanisms like firewalls.

Security SummaryAI

CVE-2020-37052 is a pre-authentication remote code execution vulnerability affecting AirControl 1.4.2. The flaw enables unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection by targeting the /.seam endpoint with a specially crafted URL containing embedded Java expressions. This issue is classified under CWE-94 (Code Injection) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity.

Unauthenticated attackers with network access can exploit this vulnerability remotely without user interaction or privileges. By sending the malicious URL, they gain the ability to run commands with the application's system privileges, potentially leading to full system compromise, including high impacts on confidentiality, integrity, and availability.

References include an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/48541), Ubiquiti's website (https://www.ui.com/), and a Vulncheck advisory detailing the pre-auth remote code execution (https://www.vulncheck.com/advisories/aircontrol-preauth-remote-code-execution), which security practitioners should review for mitigation guidance and patch information.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

Pre-authentication RCE via network-accessible endpoint enables exploitation of public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References