Privilege-0 to Root Privilege Escalation on EdgeSwitch Analysed #511025 Valid Access Control High 2019-03-31 – 82 CORS Misconfiguration leading to Private Information Disclosure Analysed #430249 Valid Access Control High 2019-06-07 – 57 Authentication bypass on sso.ubnt.com via subdomain takeover of ping.ubnt.com #172137 Duplicate Cross-Site Request Forgery High 2016-11-29 – 55 Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.com Analysed #301406 Valid No weakness recorded High 2018-03-07 – 47 View Only to Root Privilege Escalation on UniFi Protect Analysed #825764 Valid Command and Code Injection High 2021-05-23 – 42 Firmware download/install vulnerable to CSRF Analysed #323852 Valid Cross-Site Request Forgery High 2020-05-29 – 35 [dev-nightly.ubnt.com] Local File Reading Analysed #260420 Valid File and Path Handling High 2017-09-14 – 31 Readonly to Root Privilege Escalation on EdgeSwitch Analysed #796414 Valid Command and Code Injection High 2021-05-23 – 27 Directory traversal at https://nightly.ubnt.com Analysed #229622 Valid File and Path Handling High 2017-10-10 – 26 UniFi Video Server web interface Configuration Restore CSRF leading to full application compromise Analysed #329749 Valid Cross-Site Request Forgery High 2019-04-28 – 22 Stored XSS in community.ubnt.com Analysed #179164 Valid Cross-site Scripting High 2017-04-28 – 22 Exposed API-key allows to control nightly builds of firmwares (█████████ & ████████) Analysed #179986 Valid Misconfiguration and Insecure Design High 2017-10-09 – 21 Web Server Predictable Session ID on EdgeSwitch Analysed #774393 Valid Authentication High 2021-05-23 – 19 Subdomain Takeover (moderator.ubnt.com) Analysed #181665 Valid Cross-site Scripting High 2017-02-06 – 19 SNMP Community String Disclosure to ReadOnly Users on EdgeSwitch #797988 Valid Information Disclosure High 2021-05-23 – 17 Reflected XSS #304175 Valid Cross-site Scripting High 2018-09-25 – 16 Resource Consumption DOS on Edgemax v1.10.6 #406614 Valid Denial of Service High 2019-08-04 – 15 Catch mails sent to an SMTP Server over SSL using an Evil SMTP Server #519582 Valid Cryptography High 2019-08-22 – 13 Privilege escalation in the client impersonation functionality #221454 Valid Access Control High 2017-11-13 – 13 RCE in AirOS 6.2.0 Devices with CSRF bypass #703659 Valid Command and Code Injection High 2020-06-30 – 12 Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300 #289264 Valid Command and Code Injection High 2018-06-19 – 12 UniFi Video Server - Broken access control on system configuration #129698 Valid Access Control High 2018-11-07 – 12 UniFi Video Server web interface admin user Firmware Update path traversal leading to local system compromise #330051 Valid File and Path Handling High 2020-04-01 – 11 UniFi Video web interface Configuration Restore user privilege escalation #329659 Valid Access Control High 2020-04-01 – 11 Stored XSS / Bypassing .htaccess protection in http://nodebb.ubnt.com/ #202354 Valid Cross-site Scripting High 2017-09-28 – 10 UniFi Video Server - Arbitrary file upload as SYSTEM #129641 Valid File and Path Handling High 2018-11-07 – 10 Stored XSS => community.ubnt.com #294048 Valid Cross-site Scripting High 2018-01-10 – 9 Camera adoption DoS - UniFi Protect #1008579 Valid Denial of Service High 2021-02-12 – 8 Code Execution in restricted CLI of EdgeSwitch #313245 Valid Command and Code Injection High 2018-06-19 – 8 Format String Vulnerability in the EdgeSwitch restricted CLI #311884 Valid Memory Corruption High 2018-06-19 – 7 Command injection in the process of downloading the latest version of the cloud key firmware through the unifi management software. #183458 Valid Command and Code Injection High 2017-12-11 – 7 Authenticated RCE in ToughSwitch #273449 Valid Command and Code Injection High 2018-06-19 – 6 UniFi Video v3.2.2 (Windows) Local Privileges Escalation due to weak default install directory ACLs #140793 Valid Access Control High 2017-12-20 – 3