Vulnerability · Published Jan 30, 2026 · Assigned by VulnCheck

CVE-2020-37052AirControl 1.4.2 - PreAuth Remote Code Execution

Critical 9.8

In plain English

A critical-severity code injection in AirControl from Ubiquiti, Inc.. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 71% of all known vulnerabilities).

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)1.3%top 29.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection. Attackers can exploit the /.seam endpoint by crafting a specially constructed URL with embedded Java expressions to run commands with the application's system privileges.

Affected products (as reported)

Vendor	Product	Versions
Ubiquiti, Inc.	AirControl	<= 1.4.2

Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

ExploitDB-48541 exploit
Vendor Homepage product
VulnCheck Advisory: AirControl 1.4.2 - PreAuth Remote Code Execution third-party-advisory