Vulnerability in Ui Unifi Controller
CVE-2019-5456
SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.013 (69.9th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 70th percentile — 69.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.013 · newest: 0.013 · change: 0.000
Affected products
- Ui Unifi Controller
- Unifi — versions <= 5.10.21
Weakness classification (CWE)
References
- hackerone.com/reports/519582 (Permissions Required)
- community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81… (Vendor Advisory)
- community.ui.com/releases/862b962b-55f6-4324-96be-610f647d5c1c (Release Notes, Vendor Advisory)
- community.ui.com/releases/9f698d0b-8279-40d3-9f1a-d36db4813124 (Release Notes, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-5456?
- CVE-2019-5456 is a high-severity vulnerability in Ui Unifi Controller, classified under Channel Accessible by Non-Endpoint. CVSS score: 8.1/10. Published 2019-07-30.
- How severe is CVE-2019-5456?
- High severity. CVSS v3 base score is 8.1 out of 10.