Vulnerabilities > UI

DATE CVE VULNERABILITY TITLE RISK
2021-09-23 CVE-2021-22952 Code Injection vulnerability in UI Unifi Talk
A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk device(s) assigned to said network if they are not yet adopted.
network
low complexity
ui CWE-94
6.5
2021-08-31 CVE-2021-22943 Improper Authentication vulnerability in UI Unifi Protect 1.13.3
A vulnerability found in UniFi Protect application V1.18.1 and earlier permits a malicious actor who has already gained access to a network to subsequently control the Protect camera(s) assigned to said network.
low complexity
ui CWE-287
8.3
2021-08-31 CVE-2021-22944 Improper Privilege Management vulnerability in UI Unifi Protect 1.13.3
A vulnerability found in UniFi Protect application V1.18.1 and earlier allows a malicious actor with a view-only role and network access to gain the same privileges as the owner of the UniFi Protect application.
low complexity
ui CWE-269
7.7
2021-06-18 CVE-2021-33818 Resource Exhaustion vulnerability in UI Camera G3 Flex Firmware Uvc.V4.30.0.67
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.
network
low complexity
ui CWE-400
5.0
2021-06-18 CVE-2021-33820 Resource Exhaustion vulnerability in UI Camera G3 Flex Firmware Uvc.V4.30.0.67
An issue was discovered in UniFi Protect G3 FLEX Camera Version UVC.v4.30.0.67.Attacker could send a huge amount of TCP SYN packet to make web service's resource exhausted.
network
low complexity
ui CWE-400
5.0
2021-05-27 CVE-2021-22909 Improper Certificate Validation vulnerability in UI Edgemax Edgerouter Firmware
A vulnerability found in EdgeMAX EdgeRouter V2.0.9 and earlier could allow a malicious actor to execute a man-in-the-middle (MitM) attack during a firmware update.
network
high complexity
ui CWE-295
7.6
2021-05-17 CVE-2020-24755 Uncontrolled Search Path Element vulnerability in UI Unifi Video 3.10.13
In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory.
local
ui CWE-427
6.9
2021-02-23 CVE-2021-22882 Resource Exhaustion vulnerability in UI Unifi Protect Controller
UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protect controller to crash.
network
low complexity
ui CWE-400
5.0
2020-12-14 CVE-2020-8282 Cross-Site Request Forgery (CSRF) vulnerability in UI products
A security issue was found in EdgePower 24V/54V firmware v1.7.0 and earlier where, due to missing CSRF protections, an attacker would have been able to perform unauthorized remote code execution.
network
ui CWE-352
6.8
2020-11-05 CVE-2020-8267 Improper Authentication vulnerability in UI Unifi Protect Firmware
A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improperly, allowing attackers to use the API to send authenticated messages without a valid token.This vulnerability was fixed in UniFi Protect v1.14.11 and newer.This issue does not impact UniFi Cloud Key Gen 2 plus.This issue does not impact UDM-Pro customers with UniFi Protect stopped.Affected Products:UDM-Pro firmware 1.7.2 and earlier.UNVR firmware 1.3.12 and earlier.Mitigation:Update UniFi Protect to v1.14.11 or newer version; the UniFi Protect controller can be updated through your UniFi OS settings.Alternatively, you can update UNVR and UDM-Pro to:- UNVR firmware to 1.3.15 or newer.- UDM-Pro firmware to 1.8.0 or newer.
network
low complexity
ui CWE-287
5.0