Lucene search

[email protected]CVE-2023-41721

HistoryOct 25, 2023 - 6:17 p.m.

CVE-2023-41721

2023-10-2518:17:30

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve-2023-41721

unifi network application

security vulnerability

device adoption

access control

unifi gateway console

udm

udm-pro

udm-se

udr

udw

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.1 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.0005 Low

EPSS

Percentile

16.6%

JSON

Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.

Affected Products:
UDM
UDM-PRO
UDM-SE
UDR
UDW

Mitigation:
Update UniFi Network to Version 7.5.187 or later.

CPENameOperatorVersion
ui:unifi_network_applicationui unifi network applicationle7.5.176
ui:unifi_network_applicationui unifi network applicationeq7.0.23
ui:unifi_network_applicationui unifi network applicationeq6.2.25
ui:unifi_network_applicationui unifi network applicationeq7.1.68
ui:unifi_network_applicationui unifi network applicationeq7.2.97
ui:unifi_network_applicationui unifi network applicationeq7.2.91
ui:unifi_network_applicationui unifi network applicationeq7.0.20
ui:unifi_network_applicationui unifi network applicationeq6.4.54
ui:unifi_network_applicationui unifi network applicationeq6.5.55
ui:unifi_network_applicationui unifi network applicationeq7.1.65

CPE	Name	Operator	Version
ui:unifi_network_application	ui unifi network application	le	7.5.176
ui:unifi_network_application	ui unifi network application	eq	7.0.23
ui:unifi_network_application	ui unifi network application	eq	6.2.25
ui:unifi_network_application	ui unifi network application	eq	7.1.68
ui:unifi_network_application	ui unifi network application	eq	7.2.97
ui:unifi_network_application	ui unifi network application	eq	7.2.91
ui:unifi_network_application	ui unifi network application	eq	7.0.20
ui:unifi_network_application	ui unifi network application	eq	6.4.54
ui:unifi_network_application	ui unifi network application	eq	6.5.55
ui:unifi_network_application	ui unifi network application	eq	7.1.65

Rows per page:

1-10 of 341

References

community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

7.1 High

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.0005 Low

EPSS

Percentile

16.6%

JSON

Related for CVE-2023-41721

cvelist1 prion1