Vulnerabilities > UI

DATE CVE VULNERABILITY TITLE RISK
2023-02-23 CVE-2023-24104 Unspecified vulnerability in UI Unifi Dream Machine PRO Firmware 7.2.95
Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets.
network
low complexity
ui
critical
9.8
2023-02-09 CVE-2023-23912 Code Injection vulnerability in UI products
A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways (USG) Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected device to create a remote code execution vulnerability.
low complexity
ui CWE-94
8.8
2023-02-02 CVE-2023-23119 Improper Validation of Integrity Check Value vulnerability in UI Af-2X Firmware
The use of the cyclic redundancy check (CRC) algorithm for integrity check during firmware update makes Ubiquiti airFiber AF2X Radio firmware version 3.2.2 and earlier vulnerable to firmware modification attacks.
network
high complexity
ui CWE-354
5.9
2022-12-23 CVE-2022-44565 Unspecified vulnerability in UI products
An improper access validation vulnerability exists in airMAX AC <8.7.11, airFiber 60/LR <2.6.2, airFiber 60 XG/HD <v1.0.0 and airFiber GBE <1.4.1 that allows a malicious actor to retrieve status and usage data from the UISP device.
network
low complexity
ui
5.3
2022-12-05 CVE-2022-43553 Unspecified vulnerability in UI Edgemax Edgerouter Firmware 2.0.9
A remote code execution vulnerability in EdgeRouters (Version 2.0.9-hotfix.4 and earlier) allows a malicious actor with an operator account to run arbitrary administrator commands.This vulnerability is fixed in Version 2.0.9-hotfix.5 and later.
network
low complexity
ui
8.8
2022-04-01 CVE-2022-22570 Classic Buffer Overflow vulnerability in UI UA Lite Firmware
A buffer overflow vulnerability found in the UniFi Door Access Reader Lite’s (UA Lite) firmware (Version 3.8.28.24 and earlier) allows a malicious actor who has gained access to a network to control all connected UA devices.
network
low complexity
ui CWE-120
7.5
2022-01-14 CVE-2021-44530 Injection vulnerability in UI Unifi Network Controller
An injection vulnerability exists in a third-party library used in UniFi Network Version 6.5.53 and earlier (Log4J CVE-2021-44228) allows a malicious actor to control the application.
network
low complexity
ui CWE-74
7.5
2021-12-07 CVE-2021-44527 Resource Exhaustion vulnerability in UI Unifi Switch Firmware
A vulnerability found in UniFi Switch firmware Version 5.43.35 and earlier allows a malicious actor who has already gained access to the network to perform a Deny of Service (DoS) attack on the affected switch.This vulnerability is fixed in UniFi Switch firmware 5.76.6 and later.
low complexity
ui CWE-400
6.1
2021-11-24 CVE-2021-22957 Unspecified vulnerability in UI Unifi Protect 1.13.3/1.19.2
A Cross-Origin Resource Sharing (CORS) vulnerability found in UniFi Protect application Version 1.19.2 and earlier allows a malicious actor who has convinced a privileged user to access a URL with malicious code to take over said user’s account.This vulnerability is fixed in UniFi Protect application Version 1.20.0 and later.
network
ui
6.8
2021-09-23 CVE-2021-22952 Unspecified vulnerability in UI Unifi Talk
A vulnerability found in UniFi Talk application V1.12.3 and earlier permits a malicious actor who has already gained access to a network to subsequently control Talk device(s) assigned to said network if they are not yet adopted.
network
low complexity
ui
6.5