PT-2020-7622 · Ubiquiti · Unifi Controller

Sethsec · Published 2020-02-08 · Updated 2020-02-12 · CVE-2014-2225

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions UniFi Controller versions prior to 3.2.1

Description The issue allows remote attackers to hijack the authentication of administrators for various requests, including creating a new admin user, changing guest settings, blocking or unblocking users, and modifying syslog settings. Specifically, the affected API endpoints include "api/add/admin" for creating a new admin user, "api/add/wlanconf" for unspecified impact, "api/set/setting/guest access" for changing guest password, authentication method, or restricted subnets, "api/cmd/stamgr" for blocking, unblocking, or reconnecting users by MAC address, "api/set/setting/rsyslogd" for changing the syslog server or port, "api/set/setting/smtp" for unspecified impact, "api/cmd/cfgmgr" for changing syslog server, port, or authentication settings, and "api/set/setting/identity" for changing the Unifi Controller name.

Recommendations For versions prior to 3.2.1, update to version 3.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the affected API endpoints until a patch is available. Avoid using the vulnerable API endpoints for sensitive operations until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2014-2225

Affected Products

Unifi Controller

References · 4

• 🔥 http://sethsec.blogspot.com/2014/07/cve-2014-2225.html · Exploit
• 🔥 https://exploit-db.com/exploits/34187 · Exploit
• 🔥 http://seclists.org/fulldisclosure/2014/Jul/126 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2014-2225 · Security Note