PT-2017-9058 · Ubiquiti · Unifi Video

Julien Ahrens · Publicado 2017-12-27 · Atualizado 2021-09-13 · CVE-2016-6914

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ubiquiti UniFi Video versions prior to 3.8.0

Description The issue is related to weak permissions for the installation directory, allowing local users to gain SYSTEM privileges. This can be achieved via a Trojan horse taskkill.exe file.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 or later to resolve the issue.

Exploit

Correção

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-276

Identificadores relacionados

CVE-2016-6914

Produtos afetados

Unifi Video

Referências · 7

• 🔥 https://exploit-db.com/exploits/43390 · Exploit
• http://packetstormsecurity.com/files/145533/Ubiquiti-UniFi-Video-3.7.3-Windows-Local-Privilege-Escalation.html · Nota
• http://securityfocus.com/bid/102278 · Nota
• https://osv.dev/vulnerability/CVE-2016-6914 · Aviso do Fabricante
• http://seclists.org/fulldisclosure/2017/Dec/83 · Nota
• https://hackerone.com/reports/140793 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-6914 · Nota de Segurança