CVE-2020-37052
Published: 30 January 2026
Description
AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection. Attackers can exploit the /.seam endpoint by crafting a specially constructed URL with embedded Java expressions to…
more
run commands with the application's system privileges.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2020-37052 by requiring timely identification, reporting, testing, and patching of the pre-authentication Java expression injection flaw in AirControl.
Prevents exploitation of the code injection vulnerability by validating URL inputs to the /.seam endpoint against malicious Java expressions.
Limits remote unauthenticated access to the vulnerable AirControl application and /.seam endpoint through boundary protection mechanisms like firewalls.
Security SummaryAI
CVE-2020-37052 is a pre-authentication remote code execution vulnerability affecting AirControl 1.4.2. The flaw enables unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection by targeting the /.seam endpoint with a specially crafted URL containing embedded Java expressions. This issue is classified under CWE-94 (Code Injection) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity.
Unauthenticated attackers with network access can exploit this vulnerability remotely without user interaction or privileges. By sending the malicious URL, they gain the ability to run commands with the application's system privileges, potentially leading to full system compromise, including high impacts on confidentiality, integrity, and availability.
References include an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/48541), Ubiquiti's website (https://www.ui.com/), and a Vulncheck advisory detailing the pre-auth remote code execution (https://www.vulncheck.com/advisories/aircontrol-preauth-remote-code-execution), which security practitioners should review for mitigation guidance and patch information.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Pre-authentication RCE via network-accessible endpoint enables exploitation of public-facing application.