PT-2017-9058 · Ubiquiti · Unifi Video

Julien Ahrens · Published 2017-12-27 · Updated 2021-09-13 · CVE-2016-6914

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ubiquiti UniFi Video versions prior to 3.8.0

Description The issue is related to weak permissions for the installation directory, allowing local users to gain SYSTEM privileges. This can be achieved via a Trojan horse taskkill.exe file.

Recommendations For versions prior to 3.8.0, update to version 3.8.0 or later to resolve the issue.

Exploit

Fix

Incorrect Default Permissions

Weakness Enumeration

CWE-276

Related Identifiers

CVE-2016-6914

Affected Products

Unifi Video

References · 7

• 🔥 https://exploit-db.com/exploits/43390 · Exploit
• https://osv.dev/vulnerability/CVE-2016-6914 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6914 · Security Note
• http://packetstormsecurity.com/files/145533/Ubiquiti-UniFi-Video-3.7.3-Windows-Local-Privilege-Escalation.html · Note
• http://securityfocus.com/bid/102278 · Note
• http://seclists.org/fulldisclosure/2017/Dec/83 · Note
• https://hackerone.com/reports/140793 · Note