PT-2020-19997 · Ubiquiti · Airmax Airos

Published 2020-05-26 · Updated 2020-05-28 · CVE-2020-8168

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AirMax AirOS versions prior to 6.3.0

Description The issue allows attackers to abuse multiple endpoints not protected against cross-site request forgery (CSRF). As a result, authenticated users can be persuaded to visit malicious web pages, which enables attackers to perform arbitrary actions. These actions include downgrading the device's firmware to older versions, modifying configuration, uploading arbitrary firmware, exfiltrating files and tokens.

Recommendations Update to the latest AirMax AirOS firmware version available at the AirMax download page.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2020-8168

Affected Products

Airmax Airos

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-8168 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8168 · Vendor Advisory
• https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83 · Vendor Advisory
• https://community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8 · Vendor Advisory
• https://ui.com/download/airmax-m · Note
• https://community.ui.com/releases/airMAX-M-v6-3-0/c8d5dec9-4030-4d7e-b23f-6a5b35ed3d83%2C · Note
• https://community.ui.com/releases/Security-advisory-bulletin-009-009/c45b6c35-2e0d-4aeb-a9ef-e1d49bcf5fd8%2C · Note