Summary
Ubiquiti heeft kwetsbaarheden verholpen in verschillende UniFi-producten, waaronder UniFi Protect, UniFi OS, UniFi Network Application, UniFi Connect, UniFi Access Application, UniFi OS Server, UID Enterprise Agent, UniFi Connect Display Cast Pro, UniFi Enterprise Audio/Video Bridge en UniFi Talk.
Details
Interpretaties
De kwetsbaarheden betreffen voornamelijk improper input validation en improper access control binnen de genoemde UniFi-producten. Door onvoldoende validatie van invoer kunnen kwaadwillenden met netwerktoegang, soms zonder verhoogde privileges en soms met verhoogde privileges, command injection uitvoeren op het hostapparaat. Dit maakt het mogelijk om willekeurige commando's uit te voeren met de rechten van het getroffen proces of de applicatie.
Daarnaast bevatten sommige UniFi OS-apparaten een kwetsbaarheid waarbij improper neutralization van CRLF-sequenties kan leiden tot het omzeilen van authenticatiemechanismen, wat ongeautoriseerde toegang tot apparaatfuncties of beheerinterfaces mogelijk maakt.
Verder is er een kwetsbaarheid met actieve debugcode in UniFi OS-apparaten die privilege-escalatie door een aanvaller met lage privileges op het netwerk mogelijk maakt.
De kwetsbaarheden stellen een aanvaller in staat om privileges te escaleren, ongeautoriseerde acties uit te voeren en controle over de getroffen systemen te verkrijgen. Exploitatie vereist netwerktoegang, waarbij sommige kwetsbaarheden ook zonder verhoogde privileges kunnen worden misbruikt.
Oplossingen
Ubiquiti heeft updates uitgebracht om de kwetsbaarheden in de verschillende UniFi-producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Vulnerabilities 22
-
Critical 10.0
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Pr…
-
Critical 10.0
A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability f…
-
Critical 10.0
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi Ta…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Input Validation vulnerabilit…
-
Critical 9.9
A malicious actor with access to the network and low privileges could exploit an Improper Access Control vulnerability …
-
Critical 9.8
A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi En…
-
Critical 9.8
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Prot…
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
Critical 9.1
A malicious actor with access to the network and high privileges could exploit an Improper Access Control vulnerability…
-
Critical 9.1CVE-2026-77542 Public exploit
A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerabili…
-
Critical 9.0
A malicious actor with access to the network, low privileges and under certain conditions could exploit an Active Debug…
-
Critical 9.0
A malicious actor with access to the network and under certain conditions could exploit an Improper Neutralization of C…
-
Critical 9.0
A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vuln…
-
High 8.2
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Conn…
Revision history
-
#1.0.0
Initiele versie
References
-
Reference
https://community.ui.com/releases/Security-Advisory-Bulletin-067/fc4a3488-7c43-4628-8bab-f715e96dbfc9