Remote Code Execution at http://tw.corp.ubnt.com Analysed #269066 Valid Command and Code Injection Critical 2017-11-29 – 61 Ability to log in as any user without authentication if █████████ is empty Analysed #215053 Valid Authentication Critical 2017-08-08 – 54 sqli Analysed #207695 Valid SQL Injection Critical 2017-03-31 – 33 [dev-nightly.ubnt.com] Local File Reading Analysed #260420 Valid File and Path Handling High 2017-09-14 – 31 [EdgeSwitch] Web GUI command injection as root with Privilege-1 and Privilege-15 users Analysed #197958 Valid Command and Code Injection Medium 2017-07-21 – 27 Directory traversal at https://nightly.ubnt.com Analysed #229622 Valid File and Path Handling High 2017-10-10 – 26 Privilege Escalation using API->Feature #239719 Valid Access Control Critical 2017-11-24 – 23 Stored XSS in community.ubnt.com #179164 Valid Cross-site Scripting High 2017-04-28 – 22 Exposed API-key allows to control nightly builds of firmwares (█████████ & ████████) #179986 Valid Misconfiguration and Insecure Design High 2017-10-09 – 21 Subdomain Takeover (moderator.ubnt.com) #181665 Valid Cross-site Scripting High 2017-02-06 – 19 Wordpress directories/files visible to internet #201984 Valid Information Disclosure Medium 2017-03-08 – 18 [nutty.ubnt.com] DOM Based XSS nuttyapp github-btn.html #200753 Valid Cross-site Scripting Medium 2017-03-30 – 17 [account-global.ubnt.com] CRLF Injection #145128 Valid No weakness recorded Low 2017-03-31 – 17 Stored XSS in dev-ucrm-billing-demo.ubnt.com In Client Custom Attribute #275515 Valid Cross-site Scripting Low 2017-12-30 – 16 Privilege Escalation: From operator to ubnt (and root) with non-interactive Session Hijacking #241044 Valid No weakness recorded Critical 2017-11-24 – 16 CSRF: Replacing the router configuration backup having an 'operator' user and bypassing the "Referer:' whitelist protection #240098 Valid No weakness recorded Critical 2017-11-24 – 14 Privilege escalation in the client impersonation functionality #221454 Valid Access Control High 2017-11-13 – 13 [dev-unifi-go.ubnt.com] Insecure CORS, Stealing Cookies #219014 Valid Information Disclosure Medium 2017-08-28 – 12 Subdomain takeover on https://cloudfront.ubnt.com/ due to non-used CloudFront DNS entry #210188 Valid Authentication Medium 2017-05-07 – 12 [scores.ubnt.com] DOM based XSS at form.html #158484 Valid Cross-site Scripting – 2017-02-24 – 11 Reflected File Download in community.ubnt.com/restapi/ #107960 Valid No weakness recorded – 2017-05-27 – 11 Stored XSS / Bypassing .htaccess protection in http://nodebb.ubnt.com/ #202354 Valid Cross-site Scripting High 2017-09-28 – 10 HTML Injection on airlink.ubnt.com #226783 Valid Command and Code Injection Low 2017-06-22 – 9 Expired SSL certificate #220615 Valid Cryptography Low 2017-05-19 – 9 200 http code in 403 forbidden directories on main Ubnt.com domain #220150 Valid Access Control – 2017-04-19 – 9 XSS via SVG file #212253 Duplicate Cross-site Scripting Medium 2017-05-01 – 9 Reflected cross-site scripting (XSS) vulnerability in scores.ubnt.com allows attackers to inject arbitrary web script via p parameter. #208622 Valid Cross-site Scripting Medium 2017-04-07 – 9 CRLF Injection on openvpn.svc.ubnt.com #232327 Valid Injection and Smuggling Medium 2017-07-04 – 8 XSS #219170 Valid Cross-site Scripting – 2017-05-20 – 8 Content Spoofing or Text Injection in (403 forbidden page injection) and Nginx version disclosure via response header #203391 Informative Misconfiguration and Insecure Design Low 2017-04-03 – 8 XSS on Nanostation Loco M2 Airmax #158287 Valid Cross-site Scripting Medium 2017-10-02 – 8 Unauthenticated Cross-Site Scripting in Web Management Console #121941 Valid Cross-site Scripting – 2017-10-02 – 8 Command injection in the process of downloading the latest version of the cloud key firmware through the unifi management software. #183458 Valid Command and Code Injection High 2017-12-11 – 7 Privilege Escalation with Session Hijacking Having a Non-privileged Valid User #242407 Valid No weakness recorded Critical 2017-12-04 – 6 Security: Publicly accessible x.509 Public and Private Key of Ubiquiti Networks. #265701 Valid Input Validation and Logic None 2017-11-20 – 5 Weak credentials for nutty.ubnt.com #204052 Informative Authentication Medium 2017-03-29 – 4 AirFibre products vulnerable to HTTP Header injection #203673 Valid Authentication None 2017-05-17 – 4 Can upload files without authentication on AirFibre 3.2 #201529 Valid Misconfiguration and Insecure Design Low 2017-05-17 – 4 UniFi Video v3.2.2 (Windows) Local Privileges Escalation due to weak default install directory ACLs #140793 Valid Access Control High 2017-12-20 – 3