PT-2020-20071 · Ubiquiti · Unifi Protect+3

Published 2020-11-05 · Updated 2020-11-19 · CVE-2020-8267

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions UniFi Protect versions 1.14.10 and earlier UDM-Pro firmware versions 1.7.2 and earlier UNVR firmware versions 1.3.12 and earlier

Description A security issue was found in the UniFi Protect controller API, where the authentication was using x-token improperly, allowing attackers to send authenticated messages without a valid token. This issue does not impact UniFi Cloud Key Gen 2 plus or UDM-Pro customers with UniFi Protect stopped.

Recommendations Update UniFi Protect to version 1.14.11 or newer. Update UNVR firmware to version 1.3.15 or newer. Update UDM-Pro firmware to version 1.8.0 or newer.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2020-8267

Affected Products

Udm-Pro

Unvr

Unifi Cloud Key Gen 2

Unifi Protect

References · 6

• https://community.ui.com/releases/UniFi-Protect-1-14-11/928e6fac-afeb-49c2-93a5-1b3066bf2bbf · Vendor Advisory
• https://community.ui.com/releases/UniFi-Protect-NVR-Firmware-1-3-15/c2a783a6-c996-43d9-ab95-8c97ae05a98f · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-8267 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-8267 · Security Note
• https://community.ui.com/releases/UniFi-Dream-Machine-Firmware-1-8-0/deabc255-a081-49ba-8f51-131f3a13000a · Vendor Advisory
• https://t.me/cvenotify/5823 · Telegram Post