RCE in AirOS 6.2.0 Devices with CSRF bypass #703659 Valid Command and Code Injection High 2020-06-30 – 12 Privilege escalation in the client impersonation functionality #221454 Valid Access Control High 2017-11-13 – 13 Bypass blocked profile protection on aircrm.ubnt.com #332631 Valid Access Control Medium 2018-07-03 – 13 Catch mails sent to an SMTP Server over SSL using an Evil SMTP Server #519582 Valid Cryptography High 2019-08-22 – 13 UBNT Amplification DDOS Attack #221625 Valid No weakness recorded Critical 2019-02-06 – 14 CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protection #240098 Valid No weakness recorded Critical 2017-11-24 – 14 Resource Consumption DOS on Edgemax v1.10.6 #406614 Valid Denial of Service High 2019-08-04 – 15 EdgeSwitch Command Injection #508256 Valid Command and Code Injection Medium 2019-03-31 – 15 Privilege Escalation: From operator to ubnt (and root) with non-interactive Session Hijacking #241044 Valid No weakness recorded Critical 2017-11-24 – 16 Stored XSS in dev-ucrm-billing-demo.ubnt.com In Client Custom Attribute #275515 Valid Cross-site Scripting Low 2017-12-30 – 16 Reflected XSS #304175 Valid Cross-site Scripting High 2018-09-25 – 16 [account-global.ubnt.com] CRLF Injection #145128 Valid No weakness recorded Low 2017-03-31 – 17 [nutty.ubnt.com] DOM Based XSS nuttyapp github-btn.html #200753 Valid Cross-site Scripting Medium 2017-03-30 – 17 SNMP Community String Disclosure to ReadOnly Users on EdgeSwitch #797988 Valid Information Disclosure High 2021-05-23 – 17 Read-Only user can execute arbitraty shell commands on AirOS #119317 Valid Command and Code Injection – 2016-08-05 – 18 Wordpress directories/files visible to internet #201984 Valid Information Disclosure Medium 2017-03-08 – 18 Two Factor Authentication Bypass #350288 Valid Authentication Medium 2018-07-16 – 18 Subdomain Takeover (moderator.ubnt.com) #181665 Valid Cross-site Scripting High 2017-02-06 – 19 Web Server Predictable Session ID on EdgeSwitch #774393 Valid Authentication High 2021-05-23 – 19 JetBrains .idea project directory #80990 Valid Misconfiguration and Insecure Design – 2019-09-19 – 20 Shell Injection via Web Management Console (dl-fw.cgi) #121940 Valid Command and Code Injection – 2016-10-15 – 20 Arbritrary file Upload on AirMax #73480 Valid File and Path Handling – 2016-02-13 – 21 Exposed API-key allows to control nightly builds of firmwares (█████████ & ████████) #179986 Valid Misconfiguration and Insecure Design High 2017-10-09 – 21 Subdomain Takeover in http://assets.goubiquiti.com/ #109699 Valid Command and Code Injection – 2016-02-14 – 22 Read-Only user can execute arbitraty shell commands on AirOS #128750 Valid Command and Code Injection – 2016-08-05 – 22 Stored XSS in community.ubnt.com #179164 Valid Cross-site Scripting High 2017-04-28 – 22 UniFi Video Server web interface Configuration Restore CSRF leading to full application compromise #329749 Valid Cross-Site Request Forgery High 2019-04-28 – 22 Privilege Escalation using API->Feature #239719 Valid Access Control Critical 2017-11-24 – 23 Source code disclosure on https://107.23.69.180 #136891 Valid Information Disclosure – 2016-06-20 – 25 Directory traversal at https://nightly.ubnt.com #229622 Valid File and Path Handling High 2017-10-10 – 26 [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 users #197958 Valid Command and Code Injection Medium 2017-07-21 – 27 Readonly to Root Privilege Escalation on EdgeSwitch #796414 Valid Command and Code Injection High 2021-05-23 – 27 IDOR Causing Deletion of any account Analysed #156537 Valid No weakness recorded – 2016-11-29 – 30 [dev-nightly.ubnt.com] Local File Reading Analysed #260420 Valid File and Path Handling High 2017-09-14 – 31 sqli Analysed #207695 Valid SQL Injection Critical 2017-03-31 – 33 Firmware download/install vulnerable to CSRF Analysed #323852 Valid Cross-Site Request Forgery High 2020-05-29 – 35 View Only to Root Privilege Escalation on UniFi Protect Analysed #825764 Valid Command and Code Injection High 2021-05-23 – 42 Read-Only user can execute arbitraty shell commands on AirOS Analysed #139398 Valid Command and Code Injection – 2016-08-05 – 44 Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.com Analysed #301406 Valid No weakness recorded High 2018-03-07 – 47 Ability to log in as any user without authentication if █████████ is empty Analysed #215053 Valid Authentication Critical 2017-08-08 – 54 Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com #172137 Duplicate Cross-Site Request Forgery High 2016-11-29 – 55 Login as root without password on EdgeSwitchX Analysed #512958 Valid Authentication Medium 2019-03-31 – 56 Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entry Analysed #145224 Valid Access Control – 2016-11-27 – 57 CORS Misconfiguration leading to Private Information Disclosure Analysed #430249 Valid Access Control High 2019-06-07 – 57 Remote Code Execution at http://tw.corp.ubnt.com Analysed #269066 Valid Command and Code Injection Critical 2017-11-29 – 61 Public Jenkins instance with /script enabled Analysed #403402 Valid Command and Code Injection Critical 2018-09-10 – 74 Privilege-0 to Root Privilege Escalation on EdgeSwitch Analysed #511025 Valid Access Control High 2019-03-31 – 82 Privilege Escalation From user to SYSTEM via unauthenticated command execution Analysed #544928 Valid Command and Code Injection Critical 2019-11-08 – 553