Search criteria
8 vulnerabilities found for UniFi Connect Display Cast by Ubiquiti Inc
CVE-2025-27213 (GCVE-0-2025-27213)
Vulnerability from cvelistv5 – Published: 2025-08-21 00:01 – Updated: 2025-08-21 14:07
VLAI?
Summary
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and make unsupported changes to the system.
Affected Products:
UniFi Connect EV Station Pro (Version 1.5.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.9.301 and earlier)
UniFi Connect Display Cast Pro (Version 1.0.78 and earlier)
UniFi Connect Display Cast Lite (Version 1.0.3 and earlier)
Mitigation:
Update UniFi Connect EV Station Pro to Version 1.5.27 or later
Update UniFi Connect Display to Version 1.13.6 or later
Update UniFi Connect Display Cast to Version 1.10.3 or later
Update UniFi Connect Display Cast Pro to Version 1.0.83 or later
Update UniFi Connect Display Cast Lite to Version 1.1.3 or later
Severity ?
4.9 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ubiquiti Inc | UniFi Connect EV Station Pro |
Affected:
1.5.27 , < 1.5.27
(semver)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-27213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T14:07:33.904511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T14:07:45.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.5.27",
"status": "affected",
"version": "1.5.27",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.13.6",
"status": "affected",
"version": "1.13.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.10.3",
"status": "affected",
"version": "1.10.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.0.83",
"status": "affected",
"version": "1.0.83",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Lite",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.3",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and make unsupported changes to the system.\r\n\r\n \r\n\r\nAffected Products:\r\n\r\nUniFi Connect EV Station Pro (Version 1.5.18 and earlier)\r\nUniFi Connect Display (Version 1.9.324 and earlier)\r\nUniFi Connect Display Cast (Version 1.9.301 and earlier)\r\nUniFi Connect Display Cast Pro (Version 1.0.78 and earlier)\r\nUniFi Connect Display Cast Lite (Version 1.0.3 and earlier)\r\n\r\nMitigation:\r\n\r\nUpdate UniFi Connect EV Station Pro to Version 1.5.27 or later\r\nUpdate UniFi Connect Display to Version 1.13.6 or later\r\nUpdate UniFi Connect Display Cast to Version 1.10.3 or later\r\nUpdate UniFi Connect Display Cast Pro to Version 1.0.83 or later\r\nUpdate UniFi Connect Display Cast Lite to Version 1.1.3 or later"
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T00:01:24.222Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-052-052/ac1251ee-5bb5-4cdf-8a71-68acd1775bb6"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-27213",
"datePublished": "2025-08-21T00:01:24.222Z",
"dateReserved": "2025-02-20T01:00:01.799Z",
"dateUpdated": "2025-08-21T14:07:45.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27215 (GCVE-0-2025-27215)
Vulnerability from cvelistv5 – Published: 2025-08-21 00:01 – Updated: 2025-08-21 14:46
VLAI?
Summary
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system.
Affected Products:
UniFi Connect Display Cast (Version 1.10.3 and earlier)
UniFi Connect Display Cast Pro (Version 1.0.89 and earlier)
UniFi Connect Display Cast Lite (Version 1.0.3 and earlier)
Mitigation:
Update UniFi Connect Display Cast to Version 1.10.7 or later
Update UniFi Connect Display Cast Pro to Version 1.0.94 or later
Update UniFi Connect Display Cast Lite to Version 1.1.8 or later
Severity ?
8.1 (High)
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ubiquiti Inc | UniFi Connect Display Cast |
Affected:
1.10.7 , < 1.10.7
(semver)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-27215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T13:51:00.551541Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T14:46:44.681Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.10.7",
"status": "affected",
"version": "1.10.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.0.94",
"status": "affected",
"version": "1.0.94",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Lite",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.8",
"status": "affected",
"version": "1.1.8",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system.\r\n\r\n \r\n\r\nAffected Products:\r\n\r\nUniFi Connect Display Cast (Version 1.10.3 and earlier)\r\nUniFi Connect Display Cast Pro (Version 1.0.89 and earlier)\r\nUniFi Connect Display Cast Lite (Version 1.0.3 and earlier)\r\n\r\n \r\n\r\nMitigation:\r\n\r\nUpdate UniFi Connect Display Cast to Version 1.10.7 or later\r\nUpdate UniFi Connect Display Cast Pro to Version 1.0.94 or later\r\nUpdate UniFi Connect Display Cast Lite to Version 1.1.8 or later"
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T00:01:24.190Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-052-052/ac1251ee-5bb5-4cdf-8a71-68acd1775bb6"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-27215",
"datePublished": "2025-08-21T00:01:24.190Z",
"dateReserved": "2025-02-20T01:00:01.799Z",
"dateUpdated": "2025-08-21T14:46:44.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29206 (GCVE-0-2024-29206)
Vulnerability from cvelistv5 – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI?
Summary
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.
Affected Products:
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Access G2 Reader Pro (Version 1.2.172 and earlier)
UniFi Access Reader Pro (Version 2.7.238 and earlier)
UniFi Access Intercom (Version 1.0.66 and earlier)
UniFi Access Intercom Viewer (Version 1.0.5 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Access G2 Reader Pro Version 1.3.37 or later.
Update UniFi Access Reader Pro Version 2.8.19 or later.
Update UniFi Access Intercom Version 1.1.32 or later.
Update UniFi Access Intercom Viewer Version 1.1.6 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity ?
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ubiquiti Inc | UniFi Connect EV Station |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_g2_reader_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_g2_reader_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.3.37"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_reader_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_reader_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "2.8.19"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_intercom",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.1.32"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom_viewer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_intercom_viewer",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.1.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29206",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-08T15:33:56.493181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:56:59.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:55.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access G2 Reader Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.3.37",
"status": "affected",
"version": "1.3.37",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Reader Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "2.8.19",
"status": "affected",
"version": "2.8.19",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Intercom",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.32",
"status": "affected",
"version": "1.1.32",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Intercom Viewer",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.6",
"status": "affected",
"version": "1.1.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.\n\n \n\nAffected Products:\n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Access G2 Reader Pro (Version 1.2.172 and earlier)\n\nUniFi Access Reader Pro (Version 2.7.238 and earlier)\n\nUniFi Access Intercom (Version 1.0.66 and earlier)\n\nUniFi Access Intercom Viewer (Version 1.0.5 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later. \n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Access G2 Reader Pro Version 1.3.37 or later.\n\nUpdate UniFi Access Reader Pro Version 2.8.19 or later.\n\nUpdate UniFi Access Intercom Version 1.1.32 or later.\n\nUpdate UniFi Access Intercom Viewer Version 1.1.6 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later. \n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.543Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29206",
"datePublished": "2024-05-07T16:40:02.543Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:55.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29207 (GCVE-0-2024-29207)
Vulnerability from cvelistv5 – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI?
Summary
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system.
Affected Products:
UniFi Connect Application (Version 3.7.9 and earlier)
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity ?
7.5 (High)
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ubiquiti Inc | UniFi Connect Application |
Affected:
3.10.7 , < 3.10.7
(semver)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_application:3.10.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_application",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "3.10.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15 "
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-07T19:34:11.302957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:56:46.353Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:55.406Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "3.10.7",
"status": "affected",
"version": "3.10.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. \n\n \n\nAffected Products:\n\nUniFi Connect Application (Version 3.7.9 and earlier) \n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later.\n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later.\n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later.\n\n"
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.502Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29207",
"datePublished": "2024-05-07T16:40:02.502Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:55.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27213 (GCVE-0-2025-27213)
Vulnerability from nvd – Published: 2025-08-21 00:01 – Updated: 2025-08-21 14:07
VLAI?
Summary
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and make unsupported changes to the system.
Affected Products:
UniFi Connect EV Station Pro (Version 1.5.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.9.301 and earlier)
UniFi Connect Display Cast Pro (Version 1.0.78 and earlier)
UniFi Connect Display Cast Lite (Version 1.0.3 and earlier)
Mitigation:
Update UniFi Connect EV Station Pro to Version 1.5.27 or later
Update UniFi Connect Display to Version 1.13.6 or later
Update UniFi Connect Display Cast to Version 1.10.3 or later
Update UniFi Connect Display Cast Pro to Version 1.0.83 or later
Update UniFi Connect Display Cast Lite to Version 1.1.3 or later
Severity ?
4.9 (Medium)
CWE
- CWE-863 - Incorrect Authorization
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ubiquiti Inc | UniFi Connect EV Station Pro |
Affected:
1.5.27 , < 1.5.27
(semver)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-27213",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T14:07:33.904511Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "CWE-863 Incorrect Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T14:07:45.141Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.5.27",
"status": "affected",
"version": "1.5.27",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.13.6",
"status": "affected",
"version": "1.13.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.10.3",
"status": "affected",
"version": "1.10.3",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.0.83",
"status": "affected",
"version": "1.0.83",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Lite",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.3",
"status": "affected",
"version": "1.1.3",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect devices to enable Android Debug Bridge (ADB) and make unsupported changes to the system.\r\n\r\n \r\n\r\nAffected Products:\r\n\r\nUniFi Connect EV Station Pro (Version 1.5.18 and earlier)\r\nUniFi Connect Display (Version 1.9.324 and earlier)\r\nUniFi Connect Display Cast (Version 1.9.301 and earlier)\r\nUniFi Connect Display Cast Pro (Version 1.0.78 and earlier)\r\nUniFi Connect Display Cast Lite (Version 1.0.3 and earlier)\r\n\r\nMitigation:\r\n\r\nUpdate UniFi Connect EV Station Pro to Version 1.5.27 or later\r\nUpdate UniFi Connect Display to Version 1.13.6 or later\r\nUpdate UniFi Connect Display Cast to Version 1.10.3 or later\r\nUpdate UniFi Connect Display Cast Pro to Version 1.0.83 or later\r\nUpdate UniFi Connect Display Cast Lite to Version 1.1.3 or later"
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T00:01:24.222Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-052-052/ac1251ee-5bb5-4cdf-8a71-68acd1775bb6"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-27213",
"datePublished": "2025-08-21T00:01:24.222Z",
"dateReserved": "2025-02-20T01:00:01.799Z",
"dateUpdated": "2025-08-21T14:07:45.141Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2025-27215 (GCVE-0-2025-27215)
Vulnerability from nvd – Published: 2025-08-21 00:01 – Updated: 2025-08-21 14:46
VLAI?
Summary
An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system.
Affected Products:
UniFi Connect Display Cast (Version 1.10.3 and earlier)
UniFi Connect Display Cast Pro (Version 1.0.89 and earlier)
UniFi Connect Display Cast Lite (Version 1.0.3 and earlier)
Mitigation:
Update UniFi Connect Display Cast to Version 1.10.7 or later
Update UniFi Connect Display Cast Pro to Version 1.0.94 or later
Update UniFi Connect Display Cast Lite to Version 1.1.8 or later
Severity ?
8.1 (High)
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ubiquiti Inc | UniFi Connect Display Cast |
Affected:
1.10.7 , < 1.10.7
(semver)
|
||||||||||||
|
||||||||||||||
{
"containers": {
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
{
"other": {
"content": {
"id": "CVE-2025-27215",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-08-21T13:51:00.551541Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T14:46:44.681Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.10.7",
"status": "affected",
"version": "1.10.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.0.94",
"status": "affected",
"version": "1.0.94",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast Lite",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.8",
"status": "affected",
"version": "1.1.8",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Access Control could allow a malicious actor authenticated in the API of certain UniFi Connect Display Cast devices to make unsupported changes to the system.\r\n\r\n \r\n\r\nAffected Products:\r\n\r\nUniFi Connect Display Cast (Version 1.10.3 and earlier)\r\nUniFi Connect Display Cast Pro (Version 1.0.89 and earlier)\r\nUniFi Connect Display Cast Lite (Version 1.0.3 and earlier)\r\n\r\n \r\n\r\nMitigation:\r\n\r\nUpdate UniFi Connect Display Cast to Version 1.10.7 or later\r\nUpdate UniFi Connect Display Cast Pro to Version 1.0.94 or later\r\nUpdate UniFi Connect Display Cast Lite to Version 1.1.8 or later"
}
],
"providerMetadata": {
"dateUpdated": "2025-08-21T00:01:24.190Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-052-052/ac1251ee-5bb5-4cdf-8a71-68acd1775bb6"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2025-27215",
"datePublished": "2025-08-21T00:01:24.190Z",
"dateReserved": "2025-02-20T01:00:01.799Z",
"dateUpdated": "2025-08-21T14:46:44.681Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29206 (GCVE-0-2024-29206)
Vulnerability from nvd – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI?
Summary
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.
Affected Products:
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Access G2 Reader Pro (Version 1.2.172 and earlier)
UniFi Access Reader Pro (Version 2.7.238 and earlier)
UniFi Access Intercom (Version 1.0.66 and earlier)
UniFi Access Intercom Viewer (Version 1.0.5 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Access G2 Reader Pro Version 1.3.37 or later.
Update UniFi Access Reader Pro Version 2.8.19 or later.
Update UniFi Access Intercom Version 1.1.32 or later.
Update UniFi Access Intercom Viewer Version 1.1.6 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity ?
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ubiquiti Inc | UniFi Connect EV Station |
Affected:
1.2.15 , < 1.2.15
(semver)
|
|||||||||||||||||||||||||||||||||||||
|
|||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_g2_reader_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_g2_reader_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.3.37"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_reader_pro:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_reader_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "2.8.19"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_intercom",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.1.32"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom_viewer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_access_intercom_viewer",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.1.6"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29206",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-08T15:33:56.493181Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:56:59.455Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:55.425Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access G2 Reader Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.3.37",
"status": "affected",
"version": "1.3.37",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Reader Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "2.8.19",
"status": "affected",
"version": "2.8.19",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Intercom",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.32",
"status": "affected",
"version": "1.1.32",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Access Intercom Viewer",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.1.6",
"status": "affected",
"version": "1.1.6",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.\n\n \n\nAffected Products:\n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Access G2 Reader Pro (Version 1.2.172 and earlier)\n\nUniFi Access Reader Pro (Version 2.7.238 and earlier)\n\nUniFi Access Intercom (Version 1.0.66 and earlier)\n\nUniFi Access Intercom Viewer (Version 1.0.5 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later. \n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Access G2 Reader Pro Version 1.3.37 or later.\n\nUpdate UniFi Access Reader Pro Version 2.8.19 or later.\n\nUpdate UniFi Access Intercom Version 1.1.32 or later.\n\nUpdate UniFi Access Intercom Viewer Version 1.1.6 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later. \n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later."
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 2.2,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.543Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29206",
"datePublished": "2024-05-07T16:40:02.543Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:55.425Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2024-29207 (GCVE-0-2024-29207)
Vulnerability from nvd – Published: 2024-05-07 16:40 – Updated: 2024-08-02 01:10
VLAI?
Summary
An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system.
Affected Products:
UniFi Connect Application (Version 3.7.9 and earlier)
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Severity ?
7.5 (High)
CWE
- CWE-284 - Improper Access Control
Assigner
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Ubiquiti Inc | UniFi Connect Application |
Affected:
3.10.7 , < 3.10.7
(semver)
|
||||||||||||||||||||||
|
||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display_cast",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_display",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_application:3.10.7:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_application",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "3.10.7"
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15 "
}
]
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "unifi_connect_ev_station_pro",
"vendor": "ubiquiti",
"versions": [
{
"status": "affected",
"version": "1.2.15.0"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2024-29207",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-05-07T19:34:11.302957Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "CWE-284 Improper Access Control",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2024-06-04T17:56:46.353Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
},
{
"providerMetadata": {
"dateUpdated": "2024-08-02T01:10:55.406Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Application",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "3.10.7",
"status": "affected",
"version": "3.10.7",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect EV Station Pro ",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.2.15",
"status": "affected",
"version": "1.2.15",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.11.348",
"status": "affected",
"version": "1.11.348",
"versionType": "semver"
}
]
},
{
"defaultStatus": "unaffected",
"product": "UniFi Connect Display Cast",
"vendor": "Ubiquiti Inc",
"versions": [
{
"lessThan": "1.8.255",
"status": "affected",
"version": "1.8.255",
"versionType": "semver"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. \n\n \n\nAffected Products:\n\nUniFi Connect Application (Version 3.7.9 and earlier) \n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later.\n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later.\n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later.\n\n"
}
],
"metrics": [
{
"cvssV3_0": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-05-07T16:40:02.502Z",
"orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"shortName": "hackerone"
},
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
"assignerShortName": "hackerone",
"cveId": "CVE-2024-29207",
"datePublished": "2024-05-07T16:40:02.502Z",
"dateReserved": "2024-03-19T01:04:06.323Z",
"dateUpdated": "2024-08-02T01:10:55.406Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}