Privilege Escalation From user to SYSTEM via unauthenticated command execution Analysed #544928 Valid Command and Code Injection – 2019-11-08 – 553 Privilege-0 to Root Privilege Escalation on EdgeSwitch #511025 Valid Access Control – 2019-03-31 – 82 Public Jenkins instance with /script enabled #403402 Valid Command and Code Injection – 2018-09-10 – 74 Remote Code Execution at http://tw.corp.ubnt.com #269066 Valid Command and Code Injection – 2017-11-29 – 61 CORS Misconfiguration leading to Private Information Disclosure #430249 Valid Access Control – 2019-06-07 – 57 Subdomain takeover on partners.ubnt.com due to non-used CloudFront DNS entry #145224 Valid Access Control – 2016-11-27 – 57 Login as root without password on EdgeSwitchX #512958 Valid Authentication – 2019-03-31 – 56 Ability to log in as any user without authentication if █████████ is empty #215053 Valid Authentication – 2017-08-08 – 54 Unrestricted File System Access via Twig Template Injection on dev-ucrm-billing-demo.ubnt.com #301406 Valid No weakness recorded – 2018-03-07 – 47 Read-Only user can execute arbitraty shell commands on AirOS #139398 Valid Command and Code Injection – 2016-08-05 – 44 View Only to Root Privilege Escalation on UniFi Protect #825764 Valid Command and Code Injection – 2021-05-23 – 42 Firmware download/install vulnerable to CSRF #323852 Valid Cross-Site Request Forgery – 2020-05-29 – 35 sqli #207695 Valid SQL Injection – 2017-03-31 – 33 [dev-nightly.ubnt.com] Local File Reading #260420 Valid File and Path Handling – 2017-09-14 – 31 IDOR Causing Deletion of any account #156537 Valid No weakness recorded – 2016-11-29 – 30 Readonly to Root Privilege Escalation on EdgeSwitch #796414 Valid Command and Code Injection – 2021-05-23 – 27 [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 users #197958 Valid Command and Code Injection – 2017-07-21 – 27 Directory traversal at https://nightly.ubnt.com #229622 Valid File and Path Handling – 2017-10-10 – 26 Source code disclosure on https://107.23.69.180 #136891 Valid Information Disclosure – 2016-06-20 – 25 Privilege Escalation using API->Feature #239719 Valid Access Control – 2017-11-24 – 23 UniFi Video Server web interface Configuration Restore CSRF leading to full application compromise #329749 Valid Cross-Site Request Forgery – 2019-04-28 – 22 Stored XSS in community.ubnt.com #179164 Valid Cross-site Scripting – 2017-04-28 – 22 Read-Only user can execute arbitraty shell commands on AirOS #128750 Valid Command and Code Injection – 2016-08-05 – 22 Subdomain Takeover in http://assets.goubiquiti.com/ #109699 Valid Command and Code Injection – 2016-02-14 – 22 Exposed API-key allows to control nightly builds of firmwares (█████████ & ████████) #179986 Valid Misconfiguration and Insecure Design – 2017-10-09 – 21 Arbritrary file Upload on AirMax #73480 Valid File and Path Handling – 2016-02-13 – 21 Shell Injection via Web Management Console (dl-fw.cgi) #121940 Valid Command and Code Injection – 2016-10-15 – 20 JetBrains .idea project directory #80990 Valid Misconfiguration and Insecure Design – 2019-09-19 – 20 Web Server Predictable Session ID on EdgeSwitch #774393 Valid Authentication – 2021-05-23 – 19 Subdomain Takeover (moderator.ubnt.com) #181665 Valid Cross-site Scripting – 2017-02-06 – 19 Two Factor Authentication Bypass #350288 Valid Authentication – 2018-07-16 – 18 Wordpress directories/files visible to internet #201984 Valid Information Disclosure – 2017-03-08 – 18 Read-Only user can execute arbitraty shell commands on AirOS #119317 Valid Command and Code Injection – 2016-08-05 – 18 SNMP Community String Disclosure to ReadOnly Users on EdgeSwitch #797988 Valid Information Disclosure – 2021-05-23 – 17 [nutty.ubnt.com] DOM Based XSS nuttyapp github-btn.html #200753 Valid Cross-site Scripting – 2017-03-30 – 17 [account-global.ubnt.com] CRLF Injection #145128 Valid No weakness recorded – 2017-03-31 – 17 Reflected XSS #304175 Valid Cross-site Scripting – 2018-09-25 – 16 Stored XSS in dev-ucrm-billing-demo.ubnt.com In Client Custom Attribute #275515 Valid Cross-site Scripting – 2017-12-30 – 16 Privilege Escalation: From operator to ubnt (and root) with non-interactive Session Hijacking #241044 Valid No weakness recorded – 2017-11-24 – 16 EdgeSwitch Command Injection #508256 Valid Command and Code Injection – 2019-03-31 – 15 Resource Consumption DOS on Edgemax v1.10.6 #406614 Valid Denial of Service – 2019-08-04 – 15 CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protection #240098 Valid No weakness recorded – 2017-11-24 – 14 UBNT Amplification DDOS Attack #221625 Valid No weakness recorded – 2019-02-06 – 14 Catch mails sent to an SMTP Server over SSL using an Evil SMTP Server #519582 Valid Cryptography – 2019-08-22 – 13 Bypass blocked profile protection on aircrm.ubnt.com #332631 Valid Access Control – 2018-07-03 – 13 Privilege escalation in the client impersonation functionality #221454 Valid Access Control – 2017-11-13 – 13 RCE in AirOS 6.2.0 Devices with CSRF bypass #703659 Valid Command and Code Injection – 2020-06-30 – 12 Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300 #289264 Valid Command and Code Injection – 2018-06-19 – 12 [dev-unifi-go.ubnt.com] Insecure CORS, Stealing Cookies #219014 Valid Information Disclosure – 2017-08-28 – 12 Subdomain takeover on https://cloudfront.ubnt.com/ due to non-used CloudFront DNS entry #210188 Valid Authentication – 2017-05-07 – 12