Path Traversal Vulnerability in UniFi OS Devices Enables Unauthorized System Access

A malicious actor with access to the network could exploit a Path Traversal vulnerability found in UniFi OS devices to access files on the underlying system that could be manipulated to access an underlying account.

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to execute a Command Injection on the device.

A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in airMAX M, LTU, SolarPoint, and SolarSwitch devices to execute arbitrary code on the device.

Stored XSS Vulnerability in Ubiquiti airMAX M Allowing Privilege Escalation

A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scripting (XSS) vulnerability found in airMAX M devices to escalate privileges on the device.

A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found in WiFiman Desktop to obtain information about the host device.

A malicious actor with local access and low privileges could exploit an External Control of File Name or Path vulnerability found in WiFiman Desktop to execute arbitrary commands with root privileges on the host device.

Privilege Escalation via Improper Access Control in Ubiquiti WiFiman Desktop for macOS

A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in WiFiman Desktop for macOS to escalate privileges on the host device.

CSRF in Ubiquiti airMAX M Enables Unauthorized Config Changes and DoS

A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF) vulnerability found in airMAX M devices to make unauthorized changes and execute a Denial of Service (DoS) attack on the device.

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi OS devices to make unauthorized changes to the system.

Command Injection Vulnerability in UniFi OS Devices

A malicious actor with access to the network could exploit an Improper Input Validation vulnerability found in UniFi OS devices to execute a Command Injection.

Improper Access Control in UniFi Protect AI Key Allows Unauthorized Network Resource Access

A malicious actor with access to the network and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.

Local Path Traversal in UniFi Protect AI Key Enables File Manipulation

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to create or truncate files on the device.

Improper Access Control Allows Internal Resource Access in UniFi Protect AI Key

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to access internal resources through the device.

A malicious actor with access to the network and under certain conditions could exploit an Improper Input Validation vulnerability found in UniFi Protect AI Key to execute a Command Injection on the device.

Path Traversal Flaw in UniFi Protect AI Key Enables File Enumeration

A malicious actor with access to the network and under certain conditions could exploit a Path Traversal vulnerability found in UniFi Protect AI Key to obtain information about files on the device.

Improper Access Control in UniFi Protect AI Key Allows Unauthorized Access and DoS

A malicious actor with access to the network could exploit an Improper Access Control vulnerability found in UniFi Protect AI Key to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device.

A malicious actor with access to an adjacent network could exploit a Buffer Overflow vulnerability found in a DHCPv6-enabled EdgeMAX EdgeSwitch to initiate a Remote Code Execution on such device.

A malicious actor with access to the network and low privileges could exploit a series of authenticated SQL Injection vulnerabilities found in UniFi Talk Application to escalate privileges on the host device.

A malicious actor with access to the network could exploit a Server-Side Request Forgery (SSRF) vulnerability found in UniFi Talk Application to execute a Denial of Service (DoS) attack and bypass authentication in certain UniFi Talk API endpoints.

Out-of-Bounds Write in UniFi Gateways Leading to Device Denial of Service

A malicious actor with access to the network could exploit an Out-of-bounds Write vulnerability found in certain UniFi gateway devices to execute a Denial of Service (DoS) attack on the device.