CVE-2020-37052: Ubiquiti, Inc Aircontrol

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection. Attackers can exploit the /.seam endpoint by crafting a specially constructed URL with embedded Java expressions to run commands with the application's system privileges.

Affected products

• Ubiquiti, Inc Aircontrol: up to and including 1.4.2

Published 2026-01-30. Last modified 2026-06-17.