A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauth
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- Fix
- Fixed in 5.0.8, 5.1.12, 5.1.11, 5.1.10
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The vulnerability affects Ubiquiti's UniFi OS, the operating system running on UniFi network devices. An attacker with network access could exploit an access control flaw to make unauthorized changes to the affected system.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- Record last updated
- CISA remediation deadline
Due date for US federal agencies to patch
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- Ubiquiti Inc UniFi OS Server
fixed in 5.0.8
- Ubiquiti Inc UDM
fixed in 5.1.12
- Ubiquiti Inc UDM-Pro
fixed in 5.1.12
- Ubiquiti Inc UDM-SE
fixed in 5.1.12
- Ubiquiti Inc UDM-Pro-Max
fixed in 5.1.12
- Ubiquiti Inc UDM-Beast
fixed in 5.1.11
- Ubiquiti Inc EFG
fixed in 5.1.12
- Ubiquiti Inc UDW
fixed in 5.1.12
- Ubiquiti Inc UDR
fixed in 5.1.12
- Ubiquiti Inc UDR7
fixed in 5.1.12
- Ubiquiti Inc UDR-5G
fixed in 5.1.12
- Ubiquiti Inc Express 7
fixed in 5.1.12
- Ubiquiti Inc UNVR
fixed in 5.1.12
- Ubiquiti Inc UNVR-Pro
fixed in 5.1.12
- Ubiquiti Inc UNVR-Instant
fixed in 5.1.12
- Ubiquiti Inc UNVR-G2
fixed in 5.1.12
- Ubiquiti Inc UNVR-G2-Pro
fixed in 5.1.12
- Ubiquiti Inc ENVR
fixed in 5.1.12
- Ubiquiti Inc ENVR-Core
fixed in 5.1.12
- Ubiquiti Inc UNAS-2
fixed in 5.1.10
- Ubiquiti Inc UNAS-4
fixed in 5.1.10
- Ubiquiti Inc UNAS-Pro
fixed in 5.1.10
- Ubiquiti Inc UNAS-Pro-4
fixed in 5.1.10
- Ubiquiti Inc UNAS-Pro-8
fixed in 5.1.10
- Ubiquiti Inc UCKP
fixed in 5.1.12
- Ubiquiti Inc UCK
fixed in 5.1.12
- Ubiquiti Inc UCK-Enterprise
fixed in 5.1.12
- Ubiquiti Inc UCG-Ultra
fixed in 5.1.12
- Ubiquiti Inc UCG-Max
fixed in 5.1.12
- Ubiquiti Inc UCG-Fiber
fixed in 5.1.12
- Ubiquiti Inc UCG-Industrial
fixed in 5.1.12