UniFi Network Application Security Vulnerability Alert (Bulletin 036)
| Attribute | Details |
|---|---|
| Publication Date | October 23, 2023 |
| Bulletin Version | 1.0 |
| Revision | 1.0 |
| Vulnerability Description | Improper access control in device adoption; risk of unauthorized access to device configuration |
| Affected UniFi Network Versions | Up to 7.5.176 |
| Mitigation | Update to Version 7.5.187 or later |
| CVSS Base Score | 10.0 Critical |
| CVE | CVE-2023-41721 (Mathew Marcus) |
| Reference Link | https://community.ui.com/releases/UniFi-Network-Application-7-5-187/408b64c5-a485-4a37-843c-31e87140be64 |
Affected Products:
- UDM
- UDM-PRO
- UDM-SE
- UDR
- UDW
Summary
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.
Customers of UniHosted are not affected by this vulnerability.
UniHosted
At UniHosted, we stay on top and take care of issues like this (if it affects our users).