View Only to Root Privilege Escalation on UniFi Protect
Team Summary
Official summary from Ubiquiti Inc.
UniFi Protect v1.13.2 (and prior) containing vulnerabilities allowing users to run certain custom commands that can be used to assign themselves unauthorized roles, escalating their privileges. These vulnerabilities were found on UniFi Protect v1.13.2 and prior versions for Cloud Key Gen2 plus. The Fix for these vulnerabilities were included in the new version of Unifi Protect v1.13.3 (for Cloud Key Gen2 plus) and Unifi Protect v1.14.10 (for UniFi Dream Machine Pro and UNVR) More details available at: https://community.ui.com/releases/UniFi-Protect-1-13-3/f4be7d35-93a3-422b-8eef-122e442c00ba https://community.ui.com/releases/UniFi-Protect-1-14-10/48a8dbdd-b872-47fa-bbde-1d24ddf5d5b5 https://community.ui.com/releases/Security-advisory-bulletin-012-012/1bba9134-f888-4010-81c0-b0dd53b9bda4
Report Details
Additional information and metadata
State
Closed
Substate
Resolved
Submitted
Weakness
Command Injection - Generic