CVE-2023-38034: ubiquiti inc unifi access points Command Injection

Vulnerability summary

CVE-2023-38034 is a critical (CVSS 9.8) Command Injection vulnerability in ubiquiti inc unifi access points. EPSS estimates a 1.35% chance of exploitation in the next 30 days, higher than 71.1% of scored vulnerabilities.

Timeline

1. 10-08-2023
   PublishedVulnerability first disclosed.
2. 04-12-2024
   Last modifiedVulnerability information updated.

Description

A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.53 and earlier) All UniFi Switches (Version 6.5.32 and earlier) -USW Flex Mini excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update UniFi Switches to Version 6.5.59 or later.

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.