PT-2014-4566 · Ubiquiti · Unifi Controller

Published 2014-07-29 · Updated 2019-06-10 · CVE-2014-2226

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ubiquiti UniFi Controller versions prior to 3.2.1

Description The issue allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors, as the administrative password hash is logged in syslog messages.

Recommendations For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to syslog messages to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2014-2226

Affected Products

Unifi Controller

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2014-2226 · Security Note
• http://securityfocus.com/bid/68869 · Note
• http://sethsec.blogspot.com/2014/07/cve-2014-2226.html · Note
• http://packetstormsecurity.com/files/127616/Ubiquiti-UbiFi-Controller-2.4.5-Password-Hash-Disclosure.html · Note
• http://seclists.org/fulldisclosure/2014/Jul/127 · Note