Search
Find a vulnerability
Search criteria
56 vulnerabilities by ubiquiti
CVE-2019-25652 (GCVE-0-2019-25652)
Vulnerability from nvd – Published: 2026-03-27 21:19 – Updated: 2026-07-15 01:24
VLAI
EPSS
VEX
Title
UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM
Summary
UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that allows adjacent network attackers to conduct man-in-the-middle attacks by presenting a false SSL certificate during SMTP connections. Attackers can intercept SMTP traffic and obtain credentials by exploiting the insecure SSL host verification mechanism in the SMTP certificate validation process.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-30 13:56 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://community.ui.com/releases/Security-Adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/unifi-networ… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi Network Controller |
Affected:
0 , < 5.6.42
(semver)
Affected: 5.6.43 , < 5.10.22 (semver) Affected: 5.11 , < 5.11.18 (custom) cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:* cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:* cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:* |
Date Public
2019-05-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-25652",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T13:56:22.209974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T13:56:58.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Controller",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "5.6.42",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.10.22",
"status": "affected",
"version": "5.6.43",
"versionType": "semver"
},
{
"lessThan": "5.11.18",
"status": "affected",
"version": "5.11",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.6.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.22",
"versionStartIncluding": "5.6.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.18",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2019-05-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that allows adjacent network attackers to conduct man-in-the-middle attacks by presenting a false SSL certificate during SMTP connections. Attackers can intercept SMTP traffic and obtain credentials by exploiting the insecure SSL host verification mechanism in the SMTP certificate validation process."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:24:06.306Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81-a5f6-0bb84753f391"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/unifi-network-controller-improper-certificate-validation-leading-to-credential-theft-via-mitm"
}
],
"title": "UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2019-25652",
"datePublished": "2026-03-27T21:19:26.490Z",
"dateReserved": "2026-03-26T20:33:10.586Z",
"dateUpdated": "2026-07-15T01:24:06.306Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-25651 (GCVE-0-2019-25651)
Vulnerability from nvd – Published: 2026-03-27 21:16 – Updated: 2026-07-15 01:24
VLAI
EPSS
VEX
Title
Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control
Summary
Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-30 17:51 UTC
CWE
- CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://community.ui.com/releases/Security-Adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/ubiquiti-uni… | third-party-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi Network Controller |
Affected:
0 , < 5.6.42
(semver)
Affected: 5.6.43 , < 5.10.12 (semver) |
|
| Ubiquiti | UniFi UAP Firmware |
Affected:
0 , < 4.0.6
(semver)
|
|
| Ubiquiti | UniFi UAP-AC Firmware |
Affected:
0 , < 3.8.17
(semver)
|
|
| Ubiquiti | UniFi USW Firmware |
Affected:
0 , < 4.0.6
(semver)
|
|
| Ubiquiti | UniFi USG Firmware |
Affected:
0 , < 4.4.34
(semver)
|
Date Public
2019-05-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-25651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T17:51:04.700943Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T17:55:00.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Controller",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "5.6.42",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.10.12",
"status": "affected",
"version": "5.6.43",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi UAP Firmware",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "4.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi UAP-AC Firmware",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "3.8.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi USW Firmware",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "4.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi USG Firmware",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "4.4.34",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.6.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.12",
"versionStartIncluding": "5.6.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:ui:unifi_uap_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2019-05-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:24:05.621Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-004-004/462e561b-9efd-4c23-bfa7-53d59cc64ecb"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ubiquiti-unifi-devices-use-of-aes-cbc-allows-key-recovery-and-unauthorized-device-control"
}
],
"title": "Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2019-25651",
"datePublished": "2026-03-27T21:16:30.611Z",
"dateReserved": "2026-03-26T20:24:49.635Z",
"dateUpdated": "2026-07-15T01:24:05.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-45205 (GCVE-0-2024-45205)
Vulnerability from nvd – Published: 2024-12-04 01:06 – Updated: 2024-12-04 16:29
VLAI
EPSS
VEX
Summary
An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious actor with access to an adjacent network to take control of this UniFi Access Point.
Affected Products:
UniFi iOS App (Version 10.17.7 and earlier)
Mitigation:
UniFi iOS App (Version 10.18.0 or later).
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-04 16:07 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi iOS App |
Unaffected:
10.18.0 , < 10.18.0
(semver)
|
|
| ui | unifi |
Affected:
0 , < 10.18.0
(custom)
cpe:2.3:a:ui:unifi:*:*:*:*:*:ios:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ui:unifi:*:*:*:*:*:ios:*:*"
],
"defaultStatus": "unknown",
"product": "unifi",
"vendor": "ui",
"versions": [
{
"lessThan": "10.18.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45205",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T16:07:12.281245Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:29:27.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "UniFi iOS App",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "10.18.0",
"status": "unaffected",
"version": "10.18.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious actor with access to an adjacent network to take control of this UniFi Access Point.\n\n\nAffected Products:\nUniFi iOS App (Version 10.17.7 and earlier) \n \nMitigation:\nUniFi iOS App (Version 10.18.0 or later)."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T01:06:04.643Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/UniFi-iOS-10-18-0/42f02428-544c-4626-b5b3-5ae40308edc7"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-45205",
"datePublished": "2024-12-04T01:06:04.643Z",
"dateReserved": "2024-08-23T01:00:01.061Z",
"dateUpdated": "2024-12-04T16:29:27.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42028 (GCVE-0-2024-42028)
Vulnerability from nvd – Published: 2024-10-28 15:54 – Updated: 2024-10-28 18:53
VLAI
EPSS
VEX
Summary
A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server.
Severity
8.8 (High)
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 18:53 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Network Application |
Affected:
8.4.62 , ≤ 8.4.62
(semver)
|
|
| ubiquiti | unifi_network_application |
Affected:
0 , ≤ 8.4.62
(semver)
cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "unifi_network_application",
"vendor": "ubiquiti",
"versions": [
{
"lessThanOrEqual": "8.4.62",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-42028",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T18:53:01.066571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T18:53:11.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThanOrEqual": "8.4.62",
"status": "affected",
"version": "8.4.62",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T15:54:15.384Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-043-043/28e45c75-314e-4f07-a4f3-d17f67bd53f7"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-42028",
"datePublished": "2024-10-28T15:54:15.384Z",
"dateReserved": "2024-07-27T01:04:08.014Z",
"dateUpdated": "2024-10-28T18:53:11.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-44540 (GCVE-0-2024-44540)
Vulnerability from nvd – Published: 2024-09-23 00:00 – Updated: 2024-09-23 20:47
VLAI
EPSS
VEX
Summary
Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port.
Severity
6.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-23 20:43 UTC
CWE
- n/a
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ubiquiti | airmax_firmware |
Affected:
8
cpe:2.3:o:ubiquiti:airmax_firmware:8:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:ubiquiti:airmax_firmware:8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "airmax_firmware",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "8"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44540",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-23T20:43:12.642455Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-23T20:47:41.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-23T20:01:06.827Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.linkedin.com/pulse/bypass-de-login-en-airmax-ubiquiti-usando-uart-paso-tillerias-ley-hk1gf/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-44540",
"datePublished": "2024-09-23T00:00:00.000Z",
"dateReserved": "2024-08-21T00:00:00.000Z",
"dateUpdated": "2024-09-23T20:47:41.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42025 (GCVE-0-2024-42025)
Vulnerability from nvd – Published: 2024-09-13 15:47 – Updated: 2024-09-28 17:44
VLAI
EPSS
VEX
Summary
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-13 16:23 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Network Application |
Affected:
8.4.59 , < 8.4.59
(semver)
|
|
| ubiquiti | unifi_network_application |
Affected:
0 , ≤ 8.3.32
(semver)
cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "unifi_network_application",
"vendor": "ubiquiti",
"versions": [
{
"lessThanOrEqual": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42025",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-13T16:23:49.335442Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-28T17:44:02.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "8.4.59",
"status": "affected",
"version": "8.4.59",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T15:47:19.568Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-042-042/c4f68b56-cdc4-4128-b2cb-5870209d1704"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-42025",
"datePublished": "2024-09-13T15:47:19.568Z",
"dateReserved": "2024-07-27T01:04:08.013Z",
"dateUpdated": "2024-09-28T17:44:02.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37380 (GCVE-0-2024-37380)
Vulnerability from nvd – Published: 2024-07-22 18:38 – Updated: 2024-11-05 21:45
VLAI
EPSS
VEX
Summary
A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point.
Affected Products:
UniFi U6+ Access Point (Version 6.6.65 and earlier)
Mitigation:
Update your UniFi U6+ Access Point to Version 6.6.74 or later.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-23 13:34 UTC
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi U6+ Access Point |
Affected:
6.6.74 , < 6.6.74
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-23T13:34:14.507945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T21:45:45.233Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.070Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-041-041/df92860f-0379-4002-be47-6819a25a73a1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi U6+ Access Point",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "6.6.74",
"status": "affected",
"version": "6.6.74",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point.\n\n\nAffected Products:\nUniFi U6+ Access Point (Version 6.6.65 and earlier) \n\n \nMitigation:\nUpdate your UniFi U6+ Access Point to Version 6.6.74 or later.\n"
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T18:38:00.606Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-041-041/df92860f-0379-4002-be47-6819a25a73a1"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-37380",
"datePublished": "2024-07-22T18:38:00.606Z",
"dateReserved": "2024-06-07T01:04:06.870Z",
"dateUpdated": "2024-11-05T21:45:45.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-34786 (GCVE-0-2024-34786)
Vulnerability from nvd – Published: 2024-07-09 01:07 – Updated: 2025-02-10 23:05
VLAI
EPSS
VEX
Summary
UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network Application) that could cause the SSID name to change and/or the WiFi Password to be removed on the 5GHz Radio.
This vulnerability is fixed in UniFi iOS app 10.15.2 and later.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-09 17:46 UTC
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi iOS App |
Affected:
10.15.2 , < 10.15.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-34786",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-09T17:46:06.532540Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-10T23:05:24.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:59:22.620Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-040-040/b4b508c0-8453-405b-8660-1f55ade669c0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi iOS App",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "10.15.2",
"status": "affected",
"version": "10.15.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network Application) that could cause the SSID name to change and/or the WiFi Password to be removed on the 5GHz Radio.\n\nThis vulnerability is fixed in UniFi iOS app 10.15.2 and later."
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T01:07:28.069Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-040-040/b4b508c0-8453-405b-8660-1f55ade669c0"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-34786",
"datePublished": "2024-07-09T01:07:28.069Z",
"dateReserved": "2024-05-09T01:04:06.436Z",
"dateUpdated": "2025-02-10T23:05:24.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29208 (GCVE-0-2024-29208)
Vulnerability from nvd – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI
EPSS
VEX
Summary
An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password.
Affected Products:
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-09 15:45 UTC
CWE
- CWE-521 - Weak Password Requirements
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Update UniFi Connect EV Station |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | Update UniFi Connect EV Station Pro |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | Update UniFi Connect Display |
Affected:
1.11.348 , < 1.11.348
(semver)
|
|
| Ubiquiti Inc | Update UniFi Connect Display Cast |
Affected:
1.8.255 , < 1.8.255
(semver)
|
|
| ubiquiti | unifi_connect_ev_station |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_ev_station_pro |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display |
Affected:
1.11.348
cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display_cast |
Affected:
1.8.255
cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-09T15:45:33.305337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-521",
"description": "CWE-521 Weak Password Requirements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:58:11.906Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:54.459Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Update UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Update UniFi Connect EV Station Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Update UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Update UniFi Connect Display Cast ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password.\n\n \n\nAffected Products:\n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later.\n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later.\n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.495Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29208",
"datePublished": "2024-05-07T16:40:02.495Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:54.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29207 (GCVE-0-2024-29207)
Vulnerability from nvd – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI
EPSS
VEX
Summary
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system.
Affected Products:
UniFi Connect Application (Version 3.7.9 and earlier)
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-07 19:34 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Connect Application |
Affected:
3.10.7 , < 3.10.7
(semver)
|
|
| Ubiquiti Inc | UniFi Connect EV Station |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | UniFi Connect EV Station Pro |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | UniFi Connect Display |
Affected:
1.11.348 , < 1.11.348
(semver)
|
|
| Ubiquiti Inc | UniFi Connect Display Cast |
Affected:
1.8.255 , < 1.8.255
(semver)
|
|
| ubiquiti | unifi_connect_display_cast |
Affected:
1.8.255
cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display |
Affected:
1.11.348
cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_application |
Affected:
3.10.7
cpe:2.3:a:ubiquiti:unifi_connect_application:3.10.7:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_ev_station |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_ev_station_pro |
Affected:
1.2.15.0
cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_application:3.10.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_application",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "3.10.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15 "
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-07T19:34:11.302957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:56:46.353Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:55.406Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "3.10.7",
"status": "affected",
"version": "3.10.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. \n\n \n\nAffected Products:\n\nUniFi Connect Application (Version 3.7.9 and earlier) \n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later.\n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later.\n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later.\n\n"
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.502Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29207",
"datePublished": "2024-05-07T16:40:02.502Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:55.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29206 (GCVE-0-2024-29206)
Vulnerability from nvd – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI
EPSS
VEX
Summary
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.
Affected Products:
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Access G2 Reader Pro (Version 1.2.172 and earlier)
UniFi Access Reader Pro (Version 2.7.238 and earlier)
UniFi Access Intercom (Version 1.0.66 and earlier)
UniFi Access Intercom Viewer (Version 1.0.5 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Access G2 Reader Pro Version 1.3.37 or later.
Update UniFi Access Reader Pro Version 2.8.19 or later.
Update UniFi Access Intercom Version 1.1.32 or later.
Update UniFi Access Intercom Viewer Version 1.1.6 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-08 15:33 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Connect EV Station |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | UniFi Connect EV Station Pro |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | UniFi Access G2 Reader Pro |
Affected:
1.3.37 , < 1.3.37
(semver)
|
|
| Ubiquiti Inc | UniFi Access Reader Pro |
Affected:
2.8.19 , < 2.8.19
(semver)
|
|
| Ubiquiti Inc | UniFi Access Intercom |
Affected:
1.1.32 , < 1.1.32
(semver)
|
|
| Ubiquiti Inc | UniFi Access Intercom Viewer |
Affected:
1.1.6 , < 1.1.6
(semver)
|
|
| Ubiquiti Inc | UniFi Connect Display |
Affected:
1.11.348 , < 1.11.348
(semver)
|
|
| Ubiquiti Inc | UniFi Connect Display Cast |
Affected:
1.8.255 , < 1.8.255
(semver)
|
|
| ubiquiti | unifi_connect_ev_station |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_access_g2_reader_pro |
Affected:
1.3.37
cpe:2.3:a:ubiquiti:unifi_access_g2_reader_pro:*:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display |
Affected:
1.11.348
cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display_cast |
Affected:
1.8.255
cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_access_reader_pro |
Affected:
2.8.19
cpe:2.3:a:ubiquiti:unifi_access_reader_pro:*:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_access_intercom |
Affected:
1.1.32
cpe:2.3:a:ubiquiti:unifi_access_intercom:*:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_access_intercom_viewer |
Affected:
1.1.6
cpe:2.3:a:ubiquiti:unifi_access_intercom_viewer:*:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_ev_station_pro |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_g2_reader_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_g2_reader_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.3.37"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_reader_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_reader_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "2.8.19"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_intercom",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.1.32"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom_viewer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_intercom_viewer",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.1.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29206",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-08T15:33:56.493181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:56:59.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:55.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access G2 Reader Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.3.37",
"status": "affected",
"version": "1.3.37",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Reader Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "2.8.19",
"status": "affected",
"version": "2.8.19",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Intercom",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.32",
"status": "affected",
"version": "1.1.32",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Intercom Viewer",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.6",
"status": "affected",
"version": "1.1.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.\n\n \n\nAffected Products:\n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Access G2 Reader Pro (Version 1.2.172 and earlier)\n\nUniFi Access Reader Pro (Version 2.7.238 and earlier)\n\nUniFi Access Intercom (Version 1.0.66 and earlier)\n\nUniFi Access Intercom Viewer (Version 1.0.5 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later. \n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Access G2 Reader Pro Version 1.3.37 or later.\n\nUpdate UniFi Access Reader Pro Version 2.8.19 or later.\n\nUpdate UniFi Access Intercom Version 1.1.32 or later.\n\nUpdate UniFi Access Intercom Viewer Version 1.1.6 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later. \n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.543Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29206",
"datePublished": "2024-05-07T16:40:02.543Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:55.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27981 (GCVE-0-2024-27981)
Vulnerability from nvd – Published: 2024-04-04 22:16 – Updated: 2025-03-18 20:10
VLAI
EPSS
VEX
Summary
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a malicious actor with UniFi Network Application Administrator credentials to escalate privileges to root on the host device.
Affected Products:
UniFi Network Application (Version 8.0.28 and earlier) .
Mitigation:
Update UniFi Network Application to Version 8.1.113 or later.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-08 15:00 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Network Application |
Affected:
8.1.113 , < 8.1.113
(semver)
|
|
| ubiquiti | unifi_network_application |
Affected:
0 , < 8.1.113
(semver)
cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_network_application",
"vendor": "ubiquiti",
"versions": [
{
"lessThan": "8.1.113",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-08T15:00:54.373621Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-18T20:10:28.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:41:56.017Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-038-038/9d13fead-47de-4372-b2c1-745b8d6b0399"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "8.1.113",
"status": "affected",
"version": "8.1.113",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a malicious actor with UniFi Network Application Administrator credentials to escalate privileges to root on the host device.\r\n\r\nAffected Products:\r\nUniFi Network Application (Version 8.0.28 and earlier) .\r\n \r\nMitigation:\r\nUpdate UniFi Network Application to Version 8.1.113 or later."
}
],
"providerMetadata": {
"dateUpdated": "2024-04-04T22:16:29.361Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-038-038/9d13fead-47de-4372-b2c1-745b8d6b0399"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-27981",
"datePublished": "2024-04-04T22:16:29.361Z",
"dateReserved": "2024-02-29T01:04:06.640Z",
"dateUpdated": "2025-03-18T20:10:28.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-22054 (GCVE-0-2024-22054)
Vulnerability from nvd – Published: 2024-02-20 17:14 – Updated: 2025-03-27 20:55
VLAI
EPSS
VEX
Summary
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.
Affected Products:
UniFi Access Points
UniFi Switches
UniFi LTE Backup
UniFi Express (Only Mesh Mode, Router mode is not affected)
Mitigation:
Update UniFi Access Points to Version 6.6.55 or later.
Update UniFi Switches to Version 6.6.61 or later.
Update UniFi LTE Backup to Version 6.6.57 or later.
Update UniFi Express to Version 3.2.5 or later.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-21 20:40 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Access Points |
Affected:
6.6.55 , < 6.6.55
(semver)
|
|
| Ubiquiti Inc | UniFi Switches |
Affected:
6.6.61 , < 6.6.61
(semver)
|
|
| Ubiquiti Inc | UniFi LTE Backup |
Affected:
6.6.57 , < 6.6.57
(semver)
|
|
| Ubiquiti Inc | UniFi Express |
Affected:
3.2.5 , < 3.2.5
(semver)
|
|
| ubiquiti | unifi_uap_firmware |
Affected:
0 , < 6.6.55
(custom)
cpe:2.3:o:ubiquiti:unifi_uap_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:35:34.831Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-037-037/9aeeccef-ca4a-4f10-9f66-1eb400b3d027"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:ubiquiti:unifi_uap_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_uap_firmware",
"vendor": "ubiquiti",
"versions": [
{
"lessThan": "6.6.55",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-22054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T20:40:11.727545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-27T20:55:19.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Access Points",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "6.6.55",
"status": "affected",
"version": "6.6.55",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Switches",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "6.6.61",
"status": "affected",
"version": "6.6.61",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi LTE Backup",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "6.6.57",
"status": "affected",
"version": "6.6.57",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Express ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "3.2.5",
"status": "affected",
"version": "3.2.5",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.\n\n\nAffected Products:\nUniFi Access Points\nUniFi Switches\nUniFi LTE Backup\nUniFi Express (Only Mesh Mode, Router mode is not affected)\n\n \nMitigation:\nUpdate UniFi Access Points to Version 6.6.55 or later.\nUpdate UniFi Switches to Version 6.6.61 or later.\nUpdate UniFi LTE Backup to Version 6.6.57 or later.\nUpdate UniFi Express to Version 3.2.5 or later."
}
],
"providerMetadata": {
"dateUpdated": "2024-03-04T01:39:11.208Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-037-037/9aeeccef-ca4a-4f10-9f66-1eb400b3d027"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-22054",
"datePublished": "2024-02-20T17:14:34.212Z",
"dateReserved": "2024-01-05T01:04:06.642Z",
"dateUpdated": "2025-03-27T20:55:19.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41721 (GCVE-0-2023-41721)
Vulnerability from nvd – Published: 2023-10-25 00:24 – Updated: 2024-09-13 16:28
VLAI
EPSS
VEX
Summary
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.
Affected Products:
UDM
UDM-PRO
UDM-SE
UDR
UDW
Mitigation:
Update UniFi Network to Version 7.5.187 or later.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 20:25 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi Network Application |
Affected:
7.5.176 , ≤ 7.5.176
(semver)
|
|
| ubiquiti | unifi_network_application |
Affected:
0 , ≤ 7.5.176
(custom)
cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:35.513Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_network_application",
"vendor": "ubiquiti",
"versions": [
{
"lessThanOrEqual": "7.5.176",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T20:25:31.300359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T16:28:08.626Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Application",
"vendor": "Ubiquiti",
"versions": [
{
"lessThanOrEqual": "7.5.176",
"status": "affected",
"version": "7.5.176",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.\n\nAffected Products:\nUDM\nUDM-PRO\nUDM-SE\nUDR\nUDW\n \nMitigation:\nUpdate UniFi Network to Version 7.5.187 or later.\n"
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2023-10-25T00:24:34.072Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-41721",
"datePublished": "2023-10-25T00:24:34.072Z",
"dateReserved": "2023-08-31T01:00:11.771Z",
"dateUpdated": "2024-09-13T16:28:08.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31998 (GCVE-0-2023-31998)
Vulnerability from nvd – Published: 2023-07-18 01:40 – Updated: 2024-10-29 15:44
VLAI
EPSS
VEX
Summary
A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 18:55 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | EdgeRouter |
Affected:
2.0.9-hotfix.6 , ≤ 2.0.9-hotfix.6
(semver)
|
|
| Ubiquiti | Aircube |
Affected:
2.8.8 , ≤ 2.8.8
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:03:28.590Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-033-033/17f7c7c0-830b-4625-a2ee-e90e514e7b0f"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-31998",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T18:55:39.335880Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T15:44:09.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EdgeRouter",
"vendor": "Ubiquiti",
"versions": [
{
"lessThanOrEqual": "2.0.9-hotfix.6",
"status": "affected",
"version": "2.0.9-hotfix.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Aircube",
"vendor": "Ubiquiti",
"versions": [
{
"lessThanOrEqual": "2.8.8",
"status": "affected",
"version": "2.8.8",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2023-07-18T01:40:05.440Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-033-033/17f7c7c0-830b-4625-a2ee-e90e514e7b0f"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-31998",
"datePublished": "2023-07-18T01:40:05.440Z",
"dateReserved": "2023-05-01T01:00:12.219Z",
"dateUpdated": "2024-10-29T15:44:09.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-25652 (GCVE-0-2019-25652)
Vulnerability from cvelistv5 – Published: 2026-03-27 21:19 – Updated: 2026-07-15 01:24
VLAI
EPSS
VEX
Title
UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM
Summary
UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that allows adjacent network attackers to conduct man-in-the-middle attacks by presenting a false SSL certificate during SMTP connections. Attackers can intercept SMTP traffic and obtain credentials by exploiting the insecure SSL host verification mechanism in the SMTP certificate validation process.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-30 13:56 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://community.ui.com/releases/Security-Adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/unifi-networ… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi Network Controller |
Affected:
0 , < 5.6.42
(semver)
Affected: 5.6.43 , < 5.10.22 (semver) Affected: 5.11 , < 5.11.18 (custom) cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:* cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:* cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:* |
Date Public
2019-05-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-25652",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T13:56:22.209974Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T13:56:58.156Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Controller",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "5.6.42",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.10.22",
"status": "affected",
"version": "5.6.43",
"versionType": "semver"
},
{
"lessThan": "5.11.18",
"status": "affected",
"version": "5.11",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.6.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.22",
"versionStartIncluding": "5.6.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.11.18",
"versionStartIncluding": "5.11",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2019-05-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "UniFi Network Controller before version 5.10.22 and 5.11.x before 5.11.18 contains an improper certificate verification vulnerability that allows adjacent network attackers to conduct man-in-the-middle attacks by presenting a false SSL certificate during SMTP connections. Attackers can intercept SMTP traffic and obtain credentials by exploiting the insecure SSL host verification mechanism in the SMTP certificate validation process."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:24:06.306Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81-a5f6-0bb84753f391"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/unifi-network-controller-improper-certificate-validation-leading-to-credential-theft-via-mitm"
}
],
"title": "UniFi Network Controller Improper Certificate Validation Leading to Credential Theft via MITM",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2019-25652",
"datePublished": "2026-03-27T21:19:26.490Z",
"dateReserved": "2026-03-26T20:33:10.586Z",
"dateUpdated": "2026-07-15T01:24:06.306Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-25651 (GCVE-0-2019-25651)
Vulnerability from cvelistv5 – Published: 2026-03-27 21:16 – Updated: 2026-07-15 01:24
VLAI
EPSS
VEX
Title
Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control
Summary
Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-30 17:51 UTC
CWE
- CWE-327 - Use of a Broken or Risky Cryptographic Algorithm
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://community.ui.com/releases/Security-Adviso… | vendor-advisory |
| https://www.vulncheck.com/advisories/ubiquiti-uni… | third-party-advisory |
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi Network Controller |
Affected:
0 , < 5.6.42
(semver)
Affected: 5.6.43 , < 5.10.12 (semver) |
|
| Ubiquiti | UniFi UAP Firmware |
Affected:
0 , < 4.0.6
(semver)
|
|
| Ubiquiti | UniFi UAP-AC Firmware |
Affected:
0 , < 3.8.17
(semver)
|
|
| Ubiquiti | UniFi USW Firmware |
Affected:
0 , < 4.0.6
(semver)
|
|
| Ubiquiti | UniFi USG Firmware |
Affected:
0 , < 4.4.34
(semver)
|
Date Public
2019-05-15 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-25651",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-30T17:51:04.700943Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-30T17:55:00.222Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Controller",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "5.6.42",
"status": "affected",
"version": "0",
"versionType": "semver"
},
{
"lessThan": "5.10.12",
"status": "affected",
"version": "5.6.43",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi UAP Firmware",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "4.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi UAP-AC Firmware",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "3.8.17",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi USW Firmware",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "4.0.6",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi USG Firmware",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "4.4.34",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.6.42",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ui:unifi_network_controller:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.12",
"versionStartIncluding": "5.6.43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:ui:unifi_uap_firmware:*:*:*:*:*:*:*:*",
"versionEndExcluding": "4.0.6",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2019-05-15T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Ubiquiti UniFi Network Controller prior to 5.10.12 (excluding 5.6.42), UAP FW prior to 4.0.6, UAP-AC, UAP-AC v2, and UAP-AC Outdoor FW prior to 3.8.17, USW FW prior to 4.0.6, USG FW prior to 4.4.34 uses AES-CBC encryption for device-to-controller communication, which contains cryptographic weaknesses that allow attackers to recover encryption keys from captured traffic. Attackers with adjacent network access can capture sufficient encrypted traffic and exploit AES-CBC mode vulnerabilities to derive the encryption keys, enabling unauthorized control and management of network devices."
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"attackComplexity": "HIGH",
"attackRequirements": "NONE",
"attackVector": "ADJACENT",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"privilegesRequired": "NONE",
"providerUrgency": "NOT_DEFINED",
"subAvailabilityImpact": "HIGH",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "HIGH",
"userInteraction": "NONE",
"valueDensity": "NOT_DEFINED",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH",
"vulnerabilityResponseEffort": "NOT_DEFINED"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-327",
"description": "CWE-327 Use of a Broken or Risky Cryptographic Algorithm",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-07-15T01:24:05.621Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-004-004/462e561b-9efd-4c23-bfa7-53d59cc64ecb"
},
{
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/ubiquiti-unifi-devices-use-of-aes-cbc-allows-key-recovery-and-unauthorized-device-control"
}
],
"title": "Ubiquiti UniFi Devices Use of AES-CBC Allows Key Recovery and Unauthorized Device Control",
"x_generator": {
"engine": "vulncheck"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2019-25651",
"datePublished": "2026-03-27T21:16:30.611Z",
"dateReserved": "2026-03-26T20:24:49.635Z",
"dateUpdated": "2026-07-15T01:24:05.621Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2024-45205 (GCVE-0-2024-45205)
Vulnerability from cvelistv5 – Published: 2024-12-04 01:06 – Updated: 2024-12-04 16:29
VLAI
EPSS
VEX
Summary
An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious actor with access to an adjacent network to take control of this UniFi Access Point.
Affected Products:
UniFi iOS App (Version 10.17.7 and earlier)
Mitigation:
UniFi iOS App (Version 10.18.0 or later).
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-12-04 16:07 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi iOS App |
Unaffected:
10.18.0 , < 10.18.0
(semver)
|
|
| ui | unifi |
Affected:
0 , < 10.18.0
(custom)
cpe:2.3:a:ui:unifi:*:*:*:*:*:ios:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ui:unifi:*:*:*:*:*:ios:*:*"
],
"defaultStatus": "unknown",
"product": "unifi",
"vendor": "ui",
"versions": [
{
"lessThan": "10.18.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-45205",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-12-04T16:07:12.281245Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T16:29:27.075Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "UniFi iOS App",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "10.18.0",
"status": "unaffected",
"version": "10.18.0",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Certificate Validation on the UniFi iOS App managing a standalone UniFi Access Point (not using UniFi Network Application) could allow a malicious actor with access to an adjacent network to take control of this UniFi Access Point.\n\n\nAffected Products:\nUniFi iOS App (Version 10.17.7 and earlier) \n \nMitigation:\nUniFi iOS App (Version 10.18.0 or later)."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-12-04T01:06:04.643Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/UniFi-iOS-10-18-0/42f02428-544c-4626-b5b3-5ae40308edc7"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-45205",
"datePublished": "2024-12-04T01:06:04.643Z",
"dateReserved": "2024-08-23T01:00:01.061Z",
"dateUpdated": "2024-12-04T16:29:27.075Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42028 (GCVE-0-2024-42028)
Vulnerability from cvelistv5 – Published: 2024-10-28 15:54 – Updated: 2024-10-28 18:53
VLAI
EPSS
VEX
Summary
A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server.
Severity
8.8 (High)
8.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-28 18:53 UTC
CWE
- CWE-276 - Incorrect Default Permissions
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Network Application |
Affected:
8.4.62 , ≤ 8.4.62
(semver)
|
|
| ubiquiti | unifi_network_application |
Affected:
0 , ≤ 8.4.62
(semver)
cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "unifi_network_application",
"vendor": "ubiquiti",
"versions": [
{
"lessThanOrEqual": "8.4.62",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-42028",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-28T18:53:01.066571Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-276",
"description": "CWE-276 Incorrect Default Permissions",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T18:53:11.285Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThanOrEqual": "8.4.62",
"status": "affected",
"version": "8.4.62",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application (Version 8.4.62 and earlier) allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-28T15:54:15.384Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-043-043/28e45c75-314e-4f07-a4f3-d17f67bd53f7"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-42028",
"datePublished": "2024-10-28T15:54:15.384Z",
"dateReserved": "2024-07-27T01:04:08.014Z",
"dateUpdated": "2024-10-28T18:53:11.285Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-44540 (GCVE-0-2024-44540)
Vulnerability from cvelistv5 – Published: 2024-09-23 00:00 – Updated: 2024-09-23 20:47
VLAI
EPSS
VEX
Summary
Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port.
Severity
6.6 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-23 20:43 UTC
CWE
- n/a
- CWE-269 - Improper Privilege Management
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| ubiquiti | airmax_firmware |
Affected:
8
cpe:2.3:o:ubiquiti:airmax_firmware:8:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:o:ubiquiti:airmax_firmware:8:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "airmax_firmware",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "8"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 6.6,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-44540",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-23T20:43:12.642455Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-269",
"description": "CWE-269 Improper Privilege Management",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-23T20:47:41.240Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Ubiquiti AirMax firmware version firmware version 8 allows attackers with physical access to gain a privileged command shell via the UART Debugging Port."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-23T20:01:06.827Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"url": "https://www.linkedin.com/pulse/bypass-de-login-en-airmax-ubiquiti-usando-uart-paso-tillerias-ley-hk1gf/"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2024-44540",
"datePublished": "2024-09-23T00:00:00.000Z",
"dateReserved": "2024-08-21T00:00:00.000Z",
"dateUpdated": "2024-09-23T20:47:41.240Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-42025 (GCVE-0-2024-42025)
Vulnerability from cvelistv5 – Published: 2024-09-13 15:47 – Updated: 2024-09-28 17:44
VLAI
EPSS
VEX
Summary
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-13 16:23 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Network Application |
Affected:
8.4.59 , < 8.4.59
(semver)
|
|
| ubiquiti | unifi_network_application |
Affected:
0 , ≤ 8.3.32
(semver)
cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"product": "unifi_network_application",
"vendor": "ubiquiti",
"versions": [
{
"lessThanOrEqual": "8.3.32",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-42025",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-13T16:23:49.335442Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-28T17:44:02.226Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "8.4.59",
"status": "affected",
"version": "8.4.59",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T15:47:19.568Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-042-042/c4f68b56-cdc4-4128-b2cb-5870209d1704"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-42025",
"datePublished": "2024-09-13T15:47:19.568Z",
"dateReserved": "2024-07-27T01:04:08.013Z",
"dateUpdated": "2024-09-28T17:44:02.226Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-37380 (GCVE-0-2024-37380)
Vulnerability from cvelistv5 – Published: 2024-07-22 18:38 – Updated: 2024-11-05 21:45
VLAI
EPSS
VEX
Summary
A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point.
Affected Products:
UniFi U6+ Access Point (Version 6.6.65 and earlier)
Mitigation:
Update your UniFi U6+ Access Point to Version 6.6.74 or later.
Severity
5.3 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-23 13:34 UTC
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi U6+ Access Point |
Affected:
6.6.74 , < 6.6.74
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-37380",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-23T13:34:14.507945Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-11-05T21:45:45.233Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T03:50:56.070Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-041-041/df92860f-0379-4002-be47-6819a25a73a1"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi U6+ Access Point",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "6.6.74",
"status": "affected",
"version": "6.6.74",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point.\n\n\nAffected Products:\nUniFi U6+ Access Point (Version 6.6.65 and earlier) \n\n \nMitigation:\nUpdate your UniFi U6+ Access Point to Version 6.6.74 or later.\n"
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-07-22T18:38:00.606Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-041-041/df92860f-0379-4002-be47-6819a25a73a1"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-37380",
"datePublished": "2024-07-22T18:38:00.606Z",
"dateReserved": "2024-06-07T01:04:06.870Z",
"dateUpdated": "2024-11-05T21:45:45.233Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-34786 (GCVE-0-2024-34786)
Vulnerability from cvelistv5 – Published: 2024-07-09 01:07 – Updated: 2025-02-10 23:05
VLAI
EPSS
VEX
Summary
UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network Application) that could cause the SSID name to change and/or the WiFi Password to be removed on the 5GHz Radio.
This vulnerability is fixed in UniFi iOS app 10.15.2 and later.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-07-09 17:46 UTC
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi iOS App |
Affected:
10.15.2 , < 10.15.2
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-34786",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-07-09T17:46:06.532540Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "CWE-noinfo Not enough information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-02-10T23:05:24.331Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T02:59:22.620Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-040-040/b4b508c0-8453-405b-8660-1f55ade669c0"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi iOS App",
"vendor": "Ubiquiti",
"versions": [
{
"lessThan": "10.15.2",
"status": "affected",
"version": "10.15.2",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network Application) that could cause the SSID name to change and/or the WiFi Password to be removed on the 5GHz Radio.\n\nThis vulnerability is fixed in UniFi iOS app 10.15.2 and later."
}
],
"providerMetadata": {
"dateUpdated": "2024-07-09T01:07:28.069Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-040-040/b4b508c0-8453-405b-8660-1f55ade669c0"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-34786",
"datePublished": "2024-07-09T01:07:28.069Z",
"dateReserved": "2024-05-09T01:04:06.436Z",
"dateUpdated": "2025-02-10T23:05:24.331Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29206 (GCVE-0-2024-29206)
Vulnerability from cvelistv5 – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI
EPSS
VEX
Summary
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.
Affected Products:
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Access G2 Reader Pro (Version 1.2.172 and earlier)
UniFi Access Reader Pro (Version 2.7.238 and earlier)
UniFi Access Intercom (Version 1.0.66 and earlier)
UniFi Access Intercom Viewer (Version 1.0.5 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Access G2 Reader Pro Version 1.3.37 or later.
Update UniFi Access Reader Pro Version 2.8.19 or later.
Update UniFi Access Intercom Version 1.1.32 or later.
Update UniFi Access Intercom Viewer Version 1.1.6 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-08 15:33 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
16 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Connect EV Station |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | UniFi Connect EV Station Pro |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | UniFi Access G2 Reader Pro |
Affected:
1.3.37 , < 1.3.37
(semver)
|
|
| Ubiquiti Inc | UniFi Access Reader Pro |
Affected:
2.8.19 , < 2.8.19
(semver)
|
|
| Ubiquiti Inc | UniFi Access Intercom |
Affected:
1.1.32 , < 1.1.32
(semver)
|
|
| Ubiquiti Inc | UniFi Access Intercom Viewer |
Affected:
1.1.6 , < 1.1.6
(semver)
|
|
| Ubiquiti Inc | UniFi Connect Display |
Affected:
1.11.348 , < 1.11.348
(semver)
|
|
| Ubiquiti Inc | UniFi Connect Display Cast |
Affected:
1.8.255 , < 1.8.255
(semver)
|
|
| ubiquiti | unifi_connect_ev_station |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_access_g2_reader_pro |
Affected:
1.3.37
cpe:2.3:a:ubiquiti:unifi_access_g2_reader_pro:*:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display |
Affected:
1.11.348
cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display_cast |
Affected:
1.8.255
cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_access_reader_pro |
Affected:
2.8.19
cpe:2.3:a:ubiquiti:unifi_access_reader_pro:*:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_access_intercom |
Affected:
1.1.32
cpe:2.3:a:ubiquiti:unifi_access_intercom:*:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_access_intercom_viewer |
Affected:
1.1.6
cpe:2.3:a:ubiquiti:unifi_access_intercom_viewer:*:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_ev_station_pro |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_g2_reader_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_g2_reader_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.3.37"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_reader_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_reader_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "2.8.19"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_intercom",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.1.32"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom_viewer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_intercom_viewer",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.1.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29206",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-08T15:33:56.493181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:56:59.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:55.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access G2 Reader Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.3.37",
"status": "affected",
"version": "1.3.37",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Reader Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "2.8.19",
"status": "affected",
"version": "2.8.19",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Intercom",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.32",
"status": "affected",
"version": "1.1.32",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Intercom Viewer",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.6",
"status": "affected",
"version": "1.1.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.\n\n \n\nAffected Products:\n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Access G2 Reader Pro (Version 1.2.172 and earlier)\n\nUniFi Access Reader Pro (Version 2.7.238 and earlier)\n\nUniFi Access Intercom (Version 1.0.66 and earlier)\n\nUniFi Access Intercom Viewer (Version 1.0.5 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later. \n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Access G2 Reader Pro Version 1.3.37 or later.\n\nUpdate UniFi Access Reader Pro Version 2.8.19 or later.\n\nUpdate UniFi Access Intercom Version 1.1.32 or later.\n\nUpdate UniFi Access Intercom Viewer Version 1.1.6 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later. \n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.543Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29206",
"datePublished": "2024-05-07T16:40:02.543Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:55.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29207 (GCVE-0-2024-29207)
Vulnerability from cvelistv5 – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI
EPSS
VEX
Summary
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system.
Affected Products:
UniFi Connect Application (Version 3.7.9 and earlier)
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-07 19:34 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
10 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Connect Application |
Affected:
3.10.7 , < 3.10.7
(semver)
|
|
| Ubiquiti Inc | UniFi Connect EV Station |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | UniFi Connect EV Station Pro |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | UniFi Connect Display |
Affected:
1.11.348 , < 1.11.348
(semver)
|
|
| Ubiquiti Inc | UniFi Connect Display Cast |
Affected:
1.8.255 , < 1.8.255
(semver)
|
|
| ubiquiti | unifi_connect_display_cast |
Affected:
1.8.255
cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display |
Affected:
1.11.348
cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_application |
Affected:
3.10.7
cpe:2.3:a:ubiquiti:unifi_connect_application:3.10.7:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_ev_station |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_ev_station_pro |
Affected:
1.2.15.0
cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_application:3.10.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_application",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "3.10.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15 "
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-07T19:34:11.302957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:56:46.353Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:55.406Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "3.10.7",
"status": "affected",
"version": "3.10.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. \n\n \n\nAffected Products:\n\nUniFi Connect Application (Version 3.7.9 and earlier) \n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later.\n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later.\n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later.\n\n"
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.502Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29207",
"datePublished": "2024-05-07T16:40:02.502Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:55.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29208 (GCVE-0-2024-29208)
Vulnerability from cvelistv5 – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI
EPSS
VEX
Summary
An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password.
Affected Products:
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-05-09 15:45 UTC
CWE
- CWE-521 - Weak Password Requirements
Assigner
References
1 reference
Impacted products
8 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | Update UniFi Connect EV Station |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | Update UniFi Connect EV Station Pro |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|
| Ubiquiti Inc | Update UniFi Connect Display |
Affected:
1.11.348 , < 1.11.348
(semver)
|
|
| Ubiquiti Inc | Update UniFi Connect Display Cast |
Affected:
1.8.255 , < 1.8.255
(semver)
|
|
| ubiquiti | unifi_connect_ev_station |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_ev_station_pro |
Affected:
1.2.15
cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display |
Affected:
1.11.348
cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:* |
|
| ubiquiti | unifi_connect_display_cast |
Affected:
1.8.255
cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29208",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-09T15:45:33.305337Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-521",
"description": "CWE-521 Weak Password Requirements",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:58:11.906Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:54.459Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Update UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Update UniFi Connect EV Station Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Update UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Update UniFi Connect Display Cast ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password.\n\n \n\nAffected Products:\n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later.\n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later.\n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.495Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29208",
"datePublished": "2024-05-07T16:40:02.495Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:54.459Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-27981 (GCVE-0-2024-27981)
Vulnerability from cvelistv5 – Published: 2024-04-04 22:16 – Updated: 2025-03-18 20:10
VLAI
EPSS
VEX
Summary
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a malicious actor with UniFi Network Application Administrator credentials to escalate privileges to root on the host device.
Affected Products:
UniFi Network Application (Version 8.0.28 and earlier) .
Mitigation:
Update UniFi Network Application to Version 8.1.113 or later.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-04-08 15:00 UTC
CWE
- CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Network Application |
Affected:
8.1.113 , < 8.1.113
(semver)
|
|
| ubiquiti | unifi_network_application |
Affected:
0 , < 8.1.113
(semver)
cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_network_application",
"vendor": "ubiquiti",
"versions": [
{
"lessThan": "8.1.113",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-27981",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-04-08T15:00:54.373621Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-77",
"description": "CWE-77 Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-18T20:10:28.730Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T00:41:56.017Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-038-038/9d13fead-47de-4372-b2c1-745b8d6b0399"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "8.1.113",
"status": "affected",
"version": "8.1.113",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a malicious actor with UniFi Network Application Administrator credentials to escalate privileges to root on the host device.\r\n\r\nAffected Products:\r\nUniFi Network Application (Version 8.0.28 and earlier) .\r\n \r\nMitigation:\r\nUpdate UniFi Network Application to Version 8.1.113 or later."
}
],
"providerMetadata": {
"dateUpdated": "2024-04-04T22:16:29.361Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-038-038/9d13fead-47de-4372-b2c1-745b8d6b0399"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-27981",
"datePublished": "2024-04-04T22:16:29.361Z",
"dateReserved": "2024-02-29T01:04:06.640Z",
"dateUpdated": "2025-03-18T20:10:28.730Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-22054 (GCVE-0-2024-22054)
Vulnerability from cvelistv5 – Published: 2024-02-20 17:14 – Updated: 2025-03-27 20:55
VLAI
EPSS
VEX
Summary
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.
Affected Products:
UniFi Access Points
UniFi Switches
UniFi LTE Backup
UniFi Express (Only Mesh Mode, Router mode is not affected)
Mitigation:
Update UniFi Access Points to Version 6.6.55 or later.
Update UniFi Switches to Version 6.6.61 or later.
Update UniFi LTE Backup to Version 6.6.57 or later.
Update UniFi Express to Version 3.2.5 or later.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-02-21 20:40 UTC
CWE
- CWE-20 - Improper Input Validation
Assigner
References
1 reference
Impacted products
5 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti Inc | UniFi Access Points |
Affected:
6.6.55 , < 6.6.55
(semver)
|
|
| Ubiquiti Inc | UniFi Switches |
Affected:
6.6.61 , < 6.6.61
(semver)
|
|
| Ubiquiti Inc | UniFi LTE Backup |
Affected:
6.6.57 , < 6.6.57
(semver)
|
|
| Ubiquiti Inc | UniFi Express |
Affected:
3.2.5 , < 3.2.5
(semver)
|
|
| ubiquiti | unifi_uap_firmware |
Affected:
0 , < 6.6.55
(custom)
cpe:2.3:o:ubiquiti:unifi_uap_firmware:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-01T22:35:34.831Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-037-037/9aeeccef-ca4a-4f10-9f66-1eb400b3d027"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:o:ubiquiti:unifi_uap_firmware:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_uap_firmware",
"vendor": "ubiquiti",
"versions": [
{
"lessThan": "6.6.55",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2024-22054",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-02-21T20:40:11.727545Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-20",
"description": "CWE-20 Improper Input Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-03-27T20:55:19.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Access Points",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "6.6.55",
"status": "affected",
"version": "6.6.55",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Switches",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "6.6.61",
"status": "affected",
"version": "6.6.61",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi LTE Backup",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "6.6.57",
"status": "affected",
"version": "6.6.57",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Express ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "3.2.5",
"status": "affected",
"version": "3.2.5",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.\n\n\nAffected Products:\nUniFi Access Points\nUniFi Switches\nUniFi LTE Backup\nUniFi Express (Only Mesh Mode, Router mode is not affected)\n\n \nMitigation:\nUpdate UniFi Access Points to Version 6.6.55 or later.\nUpdate UniFi Switches to Version 6.6.61 or later.\nUpdate UniFi LTE Backup to Version 6.6.57 or later.\nUpdate UniFi Express to Version 3.2.5 or later."
}
],
"providerMetadata": {
"dateUpdated": "2024-03-04T01:39:11.208Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-037-037/9aeeccef-ca4a-4f10-9f66-1eb400b3d027"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-22054",
"datePublished": "2024-02-20T17:14:34.212Z",
"dateReserved": "2024-01-05T01:04:06.642Z",
"dateUpdated": "2025-03-27T20:55:19.431Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-41721 (GCVE-0-2023-41721)
Vulnerability from cvelistv5 – Published: 2023-10-25 00:24 – Updated: 2024-09-13 16:28
VLAI
EPSS
VEX
Summary
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.
Affected Products:
UDM
UDM-PRO
UDM-SE
UDR
UDW
Mitigation:
Update UniFi Network to Version 7.5.187 or later.
Severity
10 (Critical)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-09-10 20:25 UTC
CWE
- CWE-284 - Improper Access Control
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | UniFi Network Application |
Affected:
7.5.176 , ≤ 7.5.176
(semver)
|
|
| ubiquiti | unifi_network_application |
Affected:
0 , ≤ 7.5.176
(custom)
cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T19:01:35.513Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615"
}
],
"title": "CVE Program Container"
},
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_network_application",
"vendor": "ubiquiti",
"versions": [
{
"lessThanOrEqual": "7.5.176",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-41721",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-09-10T20:25:31.300359Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-09-13T16:28:08.626Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Network Application",
"vendor": "Ubiquiti",
"versions": [
{
"lessThanOrEqual": "7.5.176",
"status": "affected",
"version": "7.5.176",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.\n\nAffected Products:\nUDM\nUDM-PRO\nUDM-SE\nUDR\nUDW\n \nMitigation:\nUpdate UniFi Network to Version 7.5.187 or later.\n"
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 10,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2023-10-25T00:24:34.072Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-41721",
"datePublished": "2023-10-25T00:24:34.072Z",
"dateReserved": "2023-08-31T01:00:11.771Z",
"dateUpdated": "2024-09-13T16:28:08.626Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-31998 (GCVE-0-2023-31998)
Vulnerability from cvelistv5 – Published: 2023-07-18 01:40 – Updated: 2024-10-29 15:44
VLAI
EPSS
VEX
Summary
A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices.
Severity
5.9 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-21 18:55 UTC
CWE
- CWE-120 - Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
Assigner
References
1 reference
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ubiquiti | EdgeRouter |
Affected:
2.0.9-hotfix.6 , ≤ 2.0.9-hotfix.6
(semver)
|
|
| Ubiquiti | Aircube |
Affected:
2.8.8 , ≤ 2.8.8
(semver)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T15:03:28.590Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-033-033/17f7c7c0-830b-4625-a2ee-e90e514e7b0f"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-31998",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-21T18:55:39.335880Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-120",
"description": "CWE-120 Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-10-29T15:44:09.148Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "EdgeRouter",
"vendor": "Ubiquiti",
"versions": [
{
"lessThanOrEqual": "2.0.9-hotfix.6",
"status": "affected",
"version": "2.0.9-hotfix.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "Aircube",
"vendor": "Ubiquiti",
"versions": [
{
"lessThanOrEqual": "2.8.8",
"status": "affected",
"version": "2.8.8",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2023-07-18T01:40:05.440Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-033-033/17f7c7c0-830b-4625-a2ee-e90e514e7b0f"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2023-31998",
"datePublished": "2023-07-18T01:40:05.440Z",
"dateReserved": "2023-05-01T01:00:12.219Z",
"dateUpdated": "2024-10-29T15:44:09.148Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}