CVE-2020-37052
Published: 30 January 2026
Summary
CVE-2020-37052 is a critical-severity Code Injection (CWE-94) vulnerability in Ui (inferred from references). Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2020-37052 is a pre-authentication remote code execution vulnerability affecting AirControl 1.4.2. The flaw enables unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection by targeting the /.seam endpoint with a specially crafted URL containing embedded Java expressions. This issue is classified under CWE-94 (Code Injection) and carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical severity.
Unauthenticated attackers with network access can exploit this vulnerability remotely without user interaction or privileges. By sending the malicious URL, they gain the ability to run commands with the application's system privileges, potentially leading to full system compromise, including high impacts on confidentiality, integrity, and availability.
References include an exploit published on Exploit-DB (https://www.exploit-db.com/exploits/48541), Ubiquiti's website (https://www.ui.com/), and a Vulncheck advisory detailing the pre-auth remote code execution (https://www.vulncheck.com/advisories/aircontrol-preauth-remote-code-execution), which security practitioners should review for mitigation guidance and patch information.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-30929
Vulnerability details
AirControl 1.4.2 contains a pre-authentication remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands through malicious Java expression injection. Attackers can exploit the /.seam endpoint by crafting a specially constructed URL with embedded Java expressions to…
more
run commands with the application's system privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Pre-authentication RCE via network-accessible endpoint enables exploitation of public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2020-37052 by requiring timely identification, reporting, testing, and patching of the pre-authentication Java expression injection flaw in AirControl.
Prevents exploitation of the code injection vulnerability by validating URL inputs to the /.seam endpoint against malicious Java expressions.
Limits remote unauthenticated access to the vulnerable AirControl application and /.seam endpoint through boundary protection mechanisms like firewalls.