Vulnerability · Published Oct 25, 2023 · Assigned by hackerone
CVE-2023-41721
Critical 10.0
In plain English
A critical-severity improper access control in UniFi Network Application from Ubiquiti. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Official description
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network. Affected Products: UDM UDM-PRO UDM-SE UDR UDW Mitigation: Update UniFi Network to Version 7.5.187 or later.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Ubiquiti | UniFi Network Application | 7.5.176 – through 7.5.176 |
Weakness: CWE-284 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H