Subdomain takeover on https://cloudfront.ubnt.com/ due to non-used CloudFront DNS entry #210188 Valid Authentication Medium 2017-05-07 – 12 Stored XSS in unifi.ubnt.com #142084 Valid Cross-site Scripting – 2016-11-26 – 12 Open Redirect in unifi.ubnt.com [Controller Finder] #141355 Valid Open Redirect – 2016-09-01 – 12 UniFi Video Server - Broken access control on system configuration #129698 Valid Access Control High 2018-11-07 – 12 UniFi Video Server web interface admin user Firmware Update path traversal leading to local system compromise #330051 Valid File and Path Handling High 2020-04-01 – 11 UniFi Video Server web interface Configuration Restore path traversal leading to local system compromise #329770 Valid File and Path Handling Critical 2018-07-02 – 11 UniFi Video web interface Configuration Restore user privilege escalation #329659 Valid Access Control High 2020-04-01 – 11 [scores.ubnt.com] DOM based XSS at form.html #158484 Valid Cross-site Scripting – 2017-02-24 – 11 Reflected XSS in scores.ubnt.com #130889 Valid Cross-site Scripting – 2016-08-11 – 11 Reflected File Download in community.ubnt.com/restapi/ #107960 Valid No weakness recorded – 2017-05-27 – 11 XW 6.2.0 firmware: 5 Reflected XSS issues in link.cgi #802498 Valid Cross-site Scripting Medium 2021-10-10 – 10 Unauthenticated request allows changing hostname #802079 Valid Authentication Medium 2020-04-10 – 10 Reflected XSS in Nanostation Loco M2 - AirOS ver=6.1.7 #386570 Valid Cross-site Scripting Medium 2020-06-01 – 10 Stored XSS / Bypassing .htaccess protection in http://nodebb.ubnt.com/ #202354 Valid Cross-site Scripting High 2017-09-28 – 10 UniFi Video Server - Arbitrary file upload as SYSTEM #129641 Valid File and Path Handling High 2018-11-07 – 10 CSRF in login form would led to account takeover #50703 Valid Cross-Site Request Forgery – 2016-06-20 – 10 UniFi Video v3.10.1 (Windows) Local Privileges Escalation to SYSTEM from arbitrary filedelete and DLL hijack vulnerabilities. #530967 Valid Access Control Medium 2020-04-01 – 9 Stored XSS => community.ubnt.com #294048 Valid Cross-site Scripting High 2018-01-10 – 9 HTML Injection on airlink.ubnt.com #226783 Valid Command and Code Injection Low 2017-06-22 – 9 Expired SSL certificate #220615 Valid Cryptography Low 2017-05-19 – 9 200 http code in 403 forbidden directories on main Ubnt.com domain #220150 Valid Access Control – 2017-04-19 – 9 XSS via SVG file #212253 Duplicate Cross-site Scripting Medium 2017-05-01 – 9 Reflected cross-site scripting (XSS) vulnerability in scores.ubnt.com allows attackers to inject arbitrary web script via p parameter. #208622 Valid Cross-site Scripting Medium 2017-04-07 – 9 account.ubnt.com CSRF #101909 Valid Cross-Site Request Forgery – 2016-12-05 – 9 Camera adoption DoS - UniFi Protect #1008579 Valid Denial of Service High 2021-02-12 – 8 Code Execution in restricted CLI of EdgeSwitch #313245 Valid Command and Code Injection High 2018-06-19 – 8 CRLF Injection on openvpn.svc.ubnt.com #232327 Valid Injection and Smuggling Medium 2017-07-04 – 8 XSS #219170 Valid Cross-site Scripting – 2017-05-20 – 8 Content Spoofing or Text Injection in (403 forbidden page injection) and Nginx version disclosure via response header #203391 Informative Misconfiguration and Insecure Design Low 2017-04-03 – 8 XSS on Nanostation Loco M2 Airmax #158287 Valid Cross-site Scripting Medium 2017-10-02 – 8 Reflected Xss in AirMax [Nanostation Loco M2] #149287 Valid Cross-site Scripting – 2016-12-12 – 8 Unauthenticated Cross-Site Scripting in Web Management Console #121941 Valid Cross-site Scripting – 2017-10-02 – 8 UniFi v3.2.10 Cross-Site Request Forgeries / Referer-Check Bypass #52635 Valid Cross-Site Request Forgery – 2016-01-07 – 8 Format String Vulnerability in the EdgeSwitch restricted CLI #311884 Valid Memory Corruption High 2018-06-19 – 7 Command injection in the process of downloading the latest version of the cloud key firmware through the unifi management software. #183458 Valid Command and Code Injection High 2017-12-11 – 7 Local File Disclosure (+XSS+CSRF) in AirOS 6.2.0 devices #661647 Valid Command and Code Injection Medium 2020-06-30 – 6 Authenticated RCE in ToughSwitch #273449 Valid Command and Code Injection High 2018-06-19 – 6 Privilege Escalation with Session Hijacking Having a Non-privileged Valid User #242407 Valid No weakness recorded Critical 2017-12-04 – 6 Security: Publicly accessible x.509 Public and Private Key of Ubiquiti Networks. #265701 Valid Input Validation and Logic None 2017-11-20 – 5 Auth bypass on directory.corp.ubnt.com #116504 Valid Authentication – 2016-06-02 – 5 Weak credentials for nutty.ubnt.com #204052 Informative Authentication Medium 2017-03-29 – 4 AirFibre products vulnerable to HTTP Header injection #203673 Valid Authentication None 2017-05-17 – 4 Can upload files without authentication on AirFibre 3.2 #201529 Valid Misconfiguration and Insecure Design Low 2017-05-17 – 4 Other Buffer Overflow in PHP of the AirMax Products #74004 Valid Memory Corruption – 2016-04-07 – 4 Buffer Overflow in PHP of the AirMax Products #73491 Valid Memory Corruption – 2016-04-01 – 4 UniFi Video v3.2.2 (Windows) Local Privileges Escalation due to weak default install directory ACLs #140793 Valid Access Control High 2017-12-20 – 3 Yet another Buffer Overflow in PHP of the AirMax Products #74025 Valid Memory Corruption – 2016-04-07 – 3 3x Reflected XSS vectors for services.cgi (XM.v6.1.6, build 32290) #331368 Valid Cross-site Scripting Medium 2021-10-10 – 2