Ubiquiti vulnerabilities
144 CVEs and advisories name Ubiquiti as an affected vendor, 3 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2024-37380A misconfiguration on UniFi U6+ Access Point could cause an incorrect VLAN traffic forwarding to APs meshed to UniFi U6+ Access Point.
- CVE-2024-34786UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network
- CVE-2024-29206An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported
- CVE-2024-29207An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system.
- CVE-2024-29208An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the
- CVE-2024-27981A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and ea
- CVE-2024-22054A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device ma
- CVE-2023-41721Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176.
- CVE-2023-35085An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default
- CVE-2023-38034A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could
- CVE-2023-31998A heap overflow vulnerability found in EdgeRouters and Aircubes allows a malicious actor to interrupt UPnP service to said devices.
- CVE-2023-32000A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administra
- CVE-2023-28365A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application a
- CVE-2023-31997UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB.
- CVE-2023-2379Ubiquiti EdgeRouter X Web Service denial of service
- CVE-2023-2378Ubiquiti EdgeRouter X Web Management command injection
- CVE-2023-2377Ubiquiti EdgeRouter X Web Management command injection
- CVE-2023-2376Ubiquiti EdgeRouter X Web Management command injection
- CVE-2023-2375Ubiquiti EdgeRouter X Web Management command injection
- CVE-2023-2374Ubiquiti EdgeRouter X Web Management command injection
- CVE-2023-2373Ubiquiti EdgeRouter X Web Management command injection
- CVE-2023-1458A vulnerability has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6 and classified as critical.
- CVE-2023-1457A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6.
- CVE-2023-1456A vulnerability, which was classified as critical, has been found in Ubiquiti EdgeRouter X 2.0.9-hotfix.6.