Summary
Ubiquiti Networks heeft kwetsbaarheden verholpen in verschillende UniFi-producten, waaronder UniFi Connect Application, UniFi Talk Application, UniFi Access Application, UniFi OS, UniFi Network Application en UniFi Protect Application.
Details
Interpretaties
De kwetsbaarheden betreffen meerdere UniFi-producten en omvatten command injection, SQL-injectie, improper input validation, improper access control, server-side request forgery (SSRF), path traversal, authenticatie-bypass en persistent privilege escalation. Aanvallers met netwerktoegang, soms met beperkte privileges en soms na authenticatie, kunnen hierdoor onder meer willekeurige commando's uitvoeren, privileges escaleren, bestanden lezen of wijzigen, authenticatie omzeilen, en Denial of Service (DoS) veroorzaken. Sommige kwetsbaarheden vereisen gebruikersinteractie, zoals het bezoeken van een kwaadaardige website, terwijl andere direct via netwerktoegang kunnen worden misbruikt. De kwetsbaarheden zijn aanwezig in applicaties en platformen die gebruikt worden voor netwerkbeheer, toegangscontrole, video surveillance en beveiligingsmonitoring binnen de UniFi-productlijn.
Oplossingen
Ubiquiti Networks heeft updates uitgebracht om de kwetsbaarheden in de UniFi-producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 25
-
Critical 10.0CVE-2026-50746 Public exploit
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conn…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection v…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) in U…
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability…
-
Critical 9.0
A malicious actor with access to the network and under certain network configurations could exploit an Improper Access …
-
High 8.8
A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection v…
-
High 8.8
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …
-
High 8.8
A malicious actor with access to the network and low privileges could exploit an authenticated SQL Injection vulnerabil…
-
High 8.7
A malicious actor with access to the network and high privileges could exploit a Path Traversal vulnerability found in …
-
High 8.6
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in certain devices runn…
-
High 8.6
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Prot…
-
High 8.6
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Prot…
-
High 8.6
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Access Applica…
-
High 8.3
A malicious actor with access to the network,low privileges and under certain conditions could exploit an Improper Acce…
-
High 8.1
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …
-
High 7.7
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to e…
-
High 7.5
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Ne…
-
High 7.5
A malicious actor with access to the network and under certain conditions could exploit an Improper Initialization vuln…
-
High 7.5
A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CO…
-
High 7.5
A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi Protect Floodl…
-
High 7.5
A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper …
-
High 7.5
A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in …
-
High 7.5
A malicious actor with access to the network and under certain conditions could exploit an Incorrect Authorization vuln…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://community.ui.com/releases/Security-Advisory-Bulletin-066-066/984eceb3-49c8-4227-942d-671c289b3afc