Improper input validation in Ubiquiti Inc Unifi Access Points
CVE-2024-22054
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery. Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express (Only Mesh Mode, Router mode is not affected) Mitigation: Update UniFi Access Points to Version 6.6.55 or later. Update UniFi Switches to Version 6.6.61 or later. Update UniFi LTE Backup to Version 6.6.57 or later. Update UniFi Express to Version 3.2.5 or later.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.005 (40.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Ubiquiti Inc Unifi Access Points — versions 6.6.55
- Ubiquiti Inc Unifi Express — versions 3.2.5
- Ubiquiti Inc Unifi Lte Backup — versions 6.6.57
- Ubiquiti Inc Unifi Switches — versions 6.6.61
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2024-22054?
- CVE-2024-22054 is a high-severity vulnerability in Ubiquiti Inc Unifi Access Points, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2024-02-20.
- How severe is CVE-2024-22054?
- High severity. CVSS v3 base score is 7.5 out of 10.