An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default settings enabled could allow a Remote Code Execution (RCE).



Affected Products:
All UniFi Access Points (Version 6.5.50 and earlier)
All UniFi Switches (Version 6.5.32 and earlier)
-USW Flex Mini excluded.


Mitigation:
Update UniFi Access Points to Version 6.5.62 or later.
Update the UniFi Switches to Version 6.5.59 or later.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.05402.

Exploitation none

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Ubiquiti Inc UniFi Access Points unaffected
Version Status Constraints
6.5.50 affected ≤ 6.5.50
Ubiquiti Inc UniFi Switches unaffected
Version Status Constraints
6.5.32 affected ≤ 6.5.32

Configuration 1 [-]

AND
cpe:2.3:o:ui:unifi_uap_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:ui:u6\+:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:u6-enterprise:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:u6-enterprise-iw:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:u6-extender:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:u6-iw:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:u6-lite:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:u6-lr:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:u6-mesh:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:u6-pro:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:uap-ac-iw:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:uap-ac-lite:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:uap-ac-lr:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:uap-ac-m:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:uap-ac-m-pro:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:uap-ac-pro:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ubb:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:ubb-xg:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:uwb-xg:-:*:*:*:*:*:*:*

Configuration 2 [-]

AND
cpe:2.3:o:ui:unifi_switch_firmware:*:*:*:*:*:*:*:*
OR cpe:2.3:h:ui:us-16-150w:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:us-24-250w:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:us-48-500w:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:us-8-150w:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:us-8-60w:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:us-xg-6poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-16-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-24:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-24-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-48:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-48-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-aggregation:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-enterprise-24-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-enterprise-48-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-enterprise-8-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-enterprisexg-24:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-flex:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-flex-xg:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-industrial:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-lite-16-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-lite-8-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-mission-critical:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-pro-24:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-pro-24-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-pro-48:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-pro-48-poe:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:usw-pro-aggregation:-:*:*:*:*:*:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Ui Subscribe
U6-enterprise Subscribe
U6-enterprise-iw Subscribe
U6-extender Subscribe
U6-iw Subscribe
U6-lite Subscribe
U6-lr Subscribe
U6-mesh Subscribe
U6-pro Subscribe
U6\+ Subscribe
Uap-ac-iw Subscribe
Uap-ac-lite Subscribe
Uap-ac-lr Subscribe
Uap-ac-m Subscribe
Uap-ac-m-pro Subscribe
Uap-ac-pro Subscribe
Ubb Subscribe
Ubb-xg Subscribe
Unifi Switch Firmware Subscribe
Unifi Uap Firmware Subscribe
Us-16-150w Subscribe
Us-24-250w Subscribe
Us-48-500w Subscribe
Us-8-150w Subscribe
Us-8-60w Subscribe
Us-xg-6poe Subscribe
Usw-16-poe Subscribe
Usw-24 Subscribe
Usw-24-poe Subscribe
Usw-48 Subscribe
Usw-48-poe Subscribe
Usw-aggregation Subscribe
Usw-enterprise-24-poe Subscribe
Usw-enterprise-48-poe Subscribe
Usw-enterprise-8-poe Subscribe
Usw-enterprisexg-24 Subscribe
Usw-flex Subscribe
Usw-flex-xg Subscribe
Usw-industrial Subscribe
Usw-lite-16-poe Subscribe
Usw-lite-8-poe Subscribe
Usw-mission-critical Subscribe
Usw-pro-24 Subscribe
Usw-pro-24-poe Subscribe
Usw-pro-48 Subscribe
Usw-pro-48-poe Subscribe
Usw-pro-aggregation Subscribe
Uwb-xg Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2023-39120 An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default settings enabled could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.50 and earlier) All UniFi Switches (Version 6.5.32 and earlier) -USW Flex Mini excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update the UniFi Switches to Version 6.5.59 or later.
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-9884-44df-b1c6-63c6499f6e56 cve-icon cve-icon
History

Thu, 05 Dec 2024 08:15:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ubiquiti:unifi_access_points:*:*:*:*:*:*:*:*
cpe:2.3:o:ubiquiti:unifi_switch_firmware:*:*:*:*:*:*:*:*
Vendors & Products Ubiquiti
Ubiquiti unifi Access Points
Ubiquiti unifi Switch Firmware

Wed, 09 Oct 2024 20:15:00 +0000

Type Values Removed Values Added
First Time appeared Ubiquiti
Ubiquiti unifi Access Points
Ubiquiti unifi Switch Firmware
CPEs cpe:2.3:a:ubiquiti:unifi_access_points:*:*:*:*:*:*:*:*
cpe:2.3:o:ubiquiti:unifi_switch_firmware:*:*:*:*:*:*:*:*
Vendors & Products Ubiquiti
Ubiquiti unifi Access Points
Ubiquiti unifi Switch Firmware
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: hackerone

Published:

Updated: 2024-12-04T16:30:50.323Z

Reserved: 2023-06-13T01:00:11.784Z

Link: CVE-2023-35085

cve-icon Vulnrichment

Updated: 2024-08-02T16:23:58.703Z

cve-icon NVD

Status : Modified

Published: 2023-08-10T19:15:09.730

Modified: 2024-11-21T08:07:56.790

Link: CVE-2023-35085

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses