CVE Intelligence
Analysis AI-assisted

CVE-2020-37052: Ubiquiti AirControl pre-authentication Java expression injection RCE

AirControl 1.4.2 is reported to allow unauthenticated remote code execution through Java expression injection on the /.seam endpoint. The record carries a CVSS 3.1 score of 9.8 (critical), but it lists no affected versions, no fixed versions and no confirmed exploitation. Defenders should restrict access to the management interface and verify vendor updates.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

AirControl 1.4.2 is described as containing a pre-authentication remote code execution flaw caused by Java expression injection (CWE-94, Code Injection). According to the description, the /.seam endpoint can be abused by unauthenticated parties to run system commands with the application's privileges. The record lists a publication date of 2026-01-30.

Impact

  • The described impact is arbitrary command execution on the host running the application.
  • The record assigns CVSS 3.1 base score 9.8 with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack, low complexity, no privileges or user interaction, and high impact on confidentiality, integrity and availability.
  • The same provider also lists a CVSS 4.0 score of 9.3.

Affected products and versions

  • The description names AirControl 1.4.2.
  • The structured affected-product list is empty, so the full range of affected versions is unknown.
  • No fixed version is listed. This does not mean no fix exists. Check the vendor site at ui.com for updates.

Exploitation status

  • The record shows this CVE is not listed in the CISA KEV catalog.
  • No confirmed exploitation in the wild appears in the sources consulted.
  • The references include a public Exploit-DB entry and a VulnCheck advisory. Their presence alone is not evidence of active exploitation.

Remediation and mitigation

  • Inventory all AirControl instances and confirm their exact versions.
  • Check the vendor site and advisories for updates, and apply vendor guidance when it becomes available.
  • Restrict access to the management interface to trusted administrators and keep it off the public internet.
  • Place the service behind network segmentation or access controls and monitor it closely until a verified fix is applied.

Detection guidance

  • Review web server and application logs for unusual requests to the /.seam path, especially requests with unexpected parameter content or abnormal length.
  • Watch for unexpected child processes or outbound connections originating from the AirControl service account.
  • Treat unexplained process activity on the host as a potential incident and follow your incident response process.

Limitations of the available information

  • The record has no structured affected or fixed version data, so the exact exposure is unknown.
  • The source status is listed as Deferred, so the analysis may be incomplete.
  • No EPSS or SSVC data is present in the record.
  • Patch availability cannot be determined from the record.

Frequently asked questions

Is CVE-2020-37052 being actively exploited?

The record shows it is not listed in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted. Listed references do not by themselves prove active exploitation.

Which versions are affected?

The description names AirControl 1.4.2, but the structured affected-version list is empty, so the full range of affected versions is unknown.

What should administrators do now?

Inventory AirControl instances, restrict access to the management interface, monitor the /.seam path in logs, and check the vendor site for updates until a verified fix is applied.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.