Auth bypass in Ui Unifi Protect Firmware
CVE-2020-8267
A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improperly, allowing attackers to use the API to send authenticated messages without a valid token.This vulnerability was fixed in UniFi Protect v1.14.11 and newer.This issue does not impact UniFi Cloud Key Gen 2 plus.This issue does not impact UDM-Pro customers with UniFi Protect stopped.Affected Products:UDM-Pro firmware 1.7.2 and earlier.UNVR firmware 1.3.12 and earlier.Mitigation:Update UniFi Protect to v1.14.11 or newer version; the UniFi Protect controller can be updated through your UniFi OS settings.Alternatively, you can update UNVR and UDM-Pro to:- UNVR firmware to 1.3.15 or newer.- UDM-Pro firmware to 1.8.0 or newer.
Vulnerability class: Broken Authentication
EPSS: 0.012 (66.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.
Affected products
- Ui Unifi_protect_firmware
- N/a Unifi Protect — versions UniFi Protect v1.14.10 and earlier not fixed
Weakness classification (CWE)
References
- support@hackerone.com (x_refsource_MISC, Release Notes, Vendor Advisory)
- support@hackerone.com (Patch, x_refsource_MISC, Vendor Advisory)
- support@hackerone.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-8267?
- CVE-2020-8267 is a medium-severity vulnerability in Ui Unifi Protect Firmware, classified under Improper Authentication. CVSS score: 5.3/10. Published 2020-11-05.
- How severe is CVE-2020-8267?
- Medium severity. CVSS v3 base score is 5.3 out of 10.