PT-2020-19992 · Ubiquiti · Unifi Cloud Key

Published 2020-05-02 · Updated 2020-05-07 · CVE-2020-8157

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ubiquiti UniFi Cloud Key firmware versions prior to 1.1.11 for Cloud Key gen2 and Cloud Key gen2 Plus

Description The issue allows unrestricted root access through the serial interface (UART).

Recommendations For versions prior to 1.1.11, update the firmware to version 1.1.11 or later to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2020-8157

Affected Products

Unifi Cloud Key

References · 4

• https://community.ui.com/releases/UniFi-Cloud-Key-Firmware-1-1-11/a24e55e1-6d90-46d7-92e2-01539ec8c79d · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8157 · Vendor Advisory
• https://community.ui.com/releases/Security-advisory-bulletin-008-008/5f66ca4c-10d6-4ca5-9620-37d5a4f22413 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8157 · Security Note