CVE-2017-0932: Improper Privilege Management

Ubiquiti Networks EdgeOS version 1.9.1.1 and prior suffer from an Improper Privilege Management vulnerability due to the lack of validation on the input of the Feature functionality. An attacker with access to an operator read-only account and ssh connection to the devices could escalate privileg...

PT-2018-5162

Name of the Vulnerable Software and Affected Versions Ubiquiti Networks EdgeOS versions 1.9.1.1 and prior Description The issue is due to improper privilege management, resulting from a lack of protection of the file system. This leads to the exposure of sensitive information. An attacker with...

PT-2018-5159

Name of the Vulnerable Software and Affected Versions Ubiquiti Networks EdgeOS versions 1.9.1.1 and prior Description The issue is related to Improper Privilege Management due to the lack of validation on the input of the Feature functionality. An attacker with access to an operator read-only...

PT-2018-5161

Name of the Vulnerable Software and Affected Versions Ubiquiti Networks EdgeOS versions 1.9.1 and prior Description The issue is due to improper privilege management, resulting from a lack of protection of the file system. This allows sensitive information to be exposed. An attacker with access t...

PT-2018-5160

Name of the Vulnerable Software and Affected Versions Ubiquiti Networks EdgeOS versions 1.9.1 and prior Description The issue allows an attacker with access to an operator account to potentially gain admin privileges by luring an admin user into accessing an attacker-controlled page, exploiting a...

Ubiquiti Inc.: Privilege Escalation with Session Hijacking Having a Non-privileged Valid User

EdgeOS version 1.9.1.1 and prior, consequence of lack of protection if the file-system, exposing sensitive information, an attacker with access to an operator read-only account, can escalate privileges to admin root access in the system...

Ubiquiti Inc.: CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protection

EdgeOS version 1.9.1 and prior, the researcher was able to bypass the CSRF protection. An attacker with access to an operator read-only account, can lure an admin root user to access the attacker controlled page, doing so will allow the attacker to gain admin privileges in the system...

Ubiquiti Inc.: Privilege Escalation using API->Feature

EdgeOS version 1.9.1.1 and prior, consequence of the lack of validation on the input of the Feature functionality, an attacker with access to an operator read-only account and ssh connection to the devices, can escalate privileges to admin root access in the system. The EdgeRouter X firmware...