Ubiquiti Networks vulnerabilities
8 vulnerabilities
Known vulnerabilities in Ubiquiti Networks products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 3 products.
Products
3- Edgerouter X4 vulnerabilities
- Edgemax3 vulnerabilities
- Unifi Ap Ac Lite1 vulnerabilities
CVE-2016-7792ubiquiti_networksunifi_ap_ac_lite_firmware
EPSS score3.01%
Ubiquiti Networks UniFi 5.2.7 does not restrict access to the database, which allows remote attackers to modify the database by directly connecting to it.CVE-2017-0933ubiquiti networksedgerouter x+1EPSS score0.54%
Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from a Cross-Site Request Forgery (CSRF) vulnerability. An attacker with access to an operator (read-only) account could lure an admin (root) user to access the attacker-controlled page, allowing the attacker to gain admin privileges in the system.CVE-2017-0932ubiquiti networksedgerouter x+1EPSS score1.21%
Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation on the input of the Feature functionality. An attacker with access to an operator (read-only) account and ssh connection to the devices could escalate privileges to admin (root) access in the system.CVE-2017-0935ubiquiti networksedgerouter x+1EPSS score1.27%
Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator (read-only) account could escalate privileges to admin (root) access in the system.CVE-2017-0934ubiquiti networksedgerouter x+1EPSS score1.28%
Ubiquiti Networks EdgeOS version 1.9.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of protection of the file system leading to sensitive information being exposed. An attacker with access to an operator (read-only) account could escalate privileges to admin (root) access in the system.CVE-2019-5424ubiquiti networksedgemax+1EPSS score1.90%
In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, a privileged user can execute arbitrary shell commands over the SSH CLI interface. This allows to execute shell commands under the root user.CVE-2019-5426ubiquiti networksedgemax+1EPSS score0.81%
In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) functionalities. Remote attackers without credentials can exploit this bug to access local services or forward traffic through the device if SSH is enabled in the system settings.CVE-2019-5425ubiquiti networksedgemax+1EPSS score1.91%
In Ubiquiti Networks EdgeSwitch X v1.1.0 and prior, an authenticated user can execute arbitrary shell commands over the SSH interface bypassing the CLI interface, which allow them to escalate privileges to root.