Lucene search

[email protected]NVD:CVE-2023-35085

HistoryAug 10, 2023 - 7:15 p.m.

CVE-2023-35085

2023-08-1019:15:09

CWE-190

[email protected]

web.nvd.nist.gov

unifi

access points

switches

snmp monitoring

remote code execution

integer overflow

vulnerability

rce

update

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

71.7%

JSON

An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default settings enabled could allow a Remote Code Execution (RCE).

Affected Products:
All UniFi Access Points (Version 6.5.50 and earlier)
All UniFi Switches (Version 6.5.32 and earlier)
-USW Flex Mini excluded.

Mitigation:
Update UniFi Access Points to Version 6.5.62 or later.
Update the UniFi Switches to Version 6.5.59 or later.

Affected configurations

Nvd

Node

uiunifi_uap_firmwareRange≤6.5.50

AND

uiu6\+Match-

uiu6-enterpriseMatch-

uiu6-enterprise-iwMatch-

uiu6-extenderMatch-

uiu6-iwMatch-

uiu6-liteMatch-

uiu6-lrMatch-

uiu6-meshMatch-

uiu6-proMatch-

uiuap-ac-iwMatch-

uiuap-ac-liteMatch-

uiuap-ac-lrMatch-

uiuap-ac-mMatch-

uiuap-ac-m-proMatch-

uiuap-ac-proMatch-

uiubbMatch-

uiubb-xgMatch-

uiuwb-xgMatch-

Node

uiunifi_switch_firmwareRange≤6.5.32

AND

uius-16-150wMatch-

uius-24-250wMatch-

uius-48-500wMatch-

uius-8-150wMatch-

uius-8-60wMatch-

uius-xg-6poeMatch-

uiusw-16-poeMatch-

uiusw-24Match-

uiusw-24-poeMatch-

uiusw-48Match-

uiusw-48-poeMatch-

uiusw-aggregationMatch-

uiusw-enterprise-24-poeMatch-

uiusw-enterprise-48-poeMatch-

uiusw-enterprise-8-poeMatch-

uiusw-enterprisexg-24Match-

uiusw-flexMatch-

uiusw-flex-xgMatch-

uiusw-industrialMatch-

uiusw-lite-16-poeMatch-

uiusw-lite-8-poeMatch-

uiusw-mission-criticalMatch-

uiusw-pro-24Match-

uiusw-pro-24-poeMatch-

uiusw-pro-48Match-

uiusw-pro-48-poeMatch-

uiusw-pro-aggregationMatch-

VendorProductVersionCPE
uiunifi_uap_firmware*cpe:2.3:o:ui:unifi_uap_firmware:*:*:*:*:*:*:*:*
uiu6\+-cpe:2.3:h:ui:u6\+:-:*:*:*:*:*:*:*
uiu6-enterprise-cpe:2.3:h:ui:u6-enterprise:-:*:*:*:*:*:*:*
uiu6-enterprise-iw-cpe:2.3:h:ui:u6-enterprise-iw:-:*:*:*:*:*:*:*
uiu6-extender-cpe:2.3:h:ui:u6-extender:-:*:*:*:*:*:*:*
uiu6-iw-cpe:2.3:h:ui:u6-iw:-:*:*:*:*:*:*:*
uiu6-lite-cpe:2.3:h:ui:u6-lite:-:*:*:*:*:*:*:*
uiu6-lr-cpe:2.3:h:ui:u6-lr:-:*:*:*:*:*:*:*
uiu6-mesh-cpe:2.3:h:ui:u6-mesh:-:*:*:*:*:*:*:*
uiu6-pro-cpe:2.3:h:ui:u6-pro:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ui	unifi_uap_firmware	*	cpe:2.3:o:ui:unifi_uap_firmware::::::::
ui	u6\+	-	cpe:2.3:h:ui:u6\+:-:::::::*
ui	u6-enterprise	-	cpe:2.3:h:ui:u6-enterprise:-:::::::*
ui	u6-enterprise-iw	-	cpe:2.3:h:ui:u6-enterprise-iw:-:::::::*
ui	u6-extender	-	cpe:2.3:h:ui:u6-extender:-:::::::*
ui	u6-iw	-	cpe:2.3:h:ui:u6-iw:-:::::::*
ui	u6-lite	-	cpe:2.3:h:ui:u6-lite:-:::::::*
ui	u6-lr	-	cpe:2.3:h:ui:u6-lr:-:::::::*
ui	u6-mesh	-	cpe:2.3:h:ui:u6-mesh:-:::::::*
ui	u6-pro	-	cpe:2.3:h:ui:u6-pro:-:::::::*

Rows per page:

1-10 of 471

References

community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-9884-44df-b1c6-63c6499f6e56

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.4

Confidence

High

EPSS

0.003

Percentile

71.7%

JSON

Related for NVD:CVE-2023-35085

prion1 cvelist1 cve1