CVE-2023-31997

UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB. Applicable Cloud Keys that are both 1 running UniFi OS 3.1 and 2 hosting the UniFi Network application. "Applicable Cloud Keys" include the following: Cloud Key Gen...

PT-2023-23562 · Ubiquiti +1 · Cloud Key Gen2 +4

Name of the Vulnerable Software and Affected Versions: UniFi OS version 3.1 Cloud Key Gen2 running UniFi OS 3.1 Cloud Key Gen2 Plus running UniFi OS 3.1 Description: The issue is related to a misconfiguration in UniFi OS 3.1 that affects consoles running UniFi Network, allowing users on a local...

CVE-2023-28361

A Cross-site WebSocket Hijacking CSWSH vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM...

CVE-2023-28361

A Cross-site WebSocket Hijacking CSWSH vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM...

Cross site scripting

A Cross-site WebSocket Hijacking CSWSH vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM...

CVE-2023-28361

A Cross-site WebSocket Hijacking CSWSH vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM...

CVE-2023-28361

A Cross-site WebSocket Hijacking CSWSH vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM...

Ubiquiti UniFi Cloud Key 跨站请求伪造漏洞

Ubiquiti UniFi Cloud Key is a secret key device that supports management of UniFi networks from Ubiquiti, Inc. A security vulnerability exists in the Ubiquiti UniFi Cloud Key UniFi OS 2.5 and prior versions, which originated from a vulnerability that allows malicious actors to access certain...

PT-2023-21672 · Ubiquiti · Unifi Os

Name of the Vulnerable Software and Affected Versions: UniFi OS versions 2.5 and earlier Description: A Cross-site WebSocket Hijacking CSWSH issue allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage. The affected products...

CVE-2023-28361

Vulnerability (CVE-2023-28361) : A Cross-site WebSocket Hijacking (CSWSH) issue in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by tricking a UniFi OS user into visiting a malicious page. Affected products include Cloud Key Gen2, Cloud Key Gen2 Plus...

CVE-2023-24104

Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets...

CVE-2023-24104

Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets...

CVE-2023-24104

CVE-2023-24104 affects Ubiquiti Networks UniFi Dream Machine Pro firmware up to at least v7.2.95 . The vulnerability arises from a flaw that allows attackers to bypass domain restrictions via crafted packets . The CVSSv3.1 metrics indicate a network-based , low complexity attack with no privilege...

CVE-2023-24104

Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets...

CVE-2023-23912

A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways USG Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected devic...

CVE-2023-23912

A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways USG Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected devic...

CVE-2023-23912

A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways USG Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected devic...

CVE-2023-23912

The CVE-2023-23912 issue affects Ubiquiti EdgeOS devices (EdgeRouters up to 2.0.9-hotfix.5 and USG up to 4.4.56). The root cause is in the dhcp6c daemon, where insufficient validation of a user-supplied string enables a network-adjacent attacker connected to the WAN to achieve remote code executi...

Ubiquiti EdgeRouters 代码注入漏洞

Ubiquiti EdgeRouters is a series of edge routers from Ubiquiti USA. A security vulnerability exists in Ubiquiti EdgeRouters version 2.0.9-hotfix.5 and earlier, UniFi Security Gateways USG version 4.4.56 and earlier, which stems from a vulnerability that allows a malicious actor to connect directl...

CVE-2023-23912

A vulnerability, found in EdgeRouters Version 2.0.9-hotfix.5 and earlier and UniFi Security Gateways USG Version 4.4.56 and earlier with their DHCPv6 prefix delegation set to dhcpv6-stateless or dhcpv6-stateful, allows a malicious actor directly connected to the WAN interface of an affected devic...