Ubiquiti Inc. · Report #158287
XSS on Nanostation Loco M2 Airmax
Validstatus
mediumseverity
8upvotes
2 Oct 2017disclosed
Summary
The researcher demonstrated that an unauthenticated POST request with crafted parameters could cause reflected-XSS due to lack of input sanitization on airOS v5.6.8. Fixes have been released with airOS v5.6.15 and airOS v6.0.1.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.