« Volver al listado

CVE-2023-41721

Estado: ModificadaMedia (5.3)—

Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.

Affected Products: UDM UDM-PRO UDM-SE UDR UDW

Mitigation: Update UniFi Network to Version 7.5.187 or later.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

UI — Unifi Network Application

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-41721",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-41721",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-09-10T20:25:31.300359Z"
        }
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Secondary",
        "source": "support@hackerone.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.0",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "support@hackerone.com",
      "affectedData": [
        {
          "vendor": "Ubiquiti",
          "product": "UniFi Network Application",
          "versions": [
            {
              "status": "affected",
              "version": "7.5.176",
              "versionType": "semver",
              "lessThanOrEqual": "7.5.176"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:ubiquiti:unifi_network_application:*:*:*:*:*:*:*:*"
          ],
          "vendor": "ubiquiti",
          "product": "unifi_network_application",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "7.5.176"
            }
          ],
          "defaultStatus": "unknown"
        }
      ]
    }
  ],
  "published": "2023-10-25T18:17:30.987",
  "references": [
    {
      "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "support@hackerone.com"
    },
    {
      "url": "https://community.ui.com/releases/Security-Advisory-Bulletin-036-036/81367bc9-2a64-4435-95dc-bbe482457615",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network.\n\nAffected Products:\nUDM\nUDM-PRO\nUDM-SE\nUDR\nUDW\n \nMitigation:\nUpdate UniFi Network to Version 7.5.187 or later.\n"
    },
    {
      "lang": "es",
      "value": "Instancias de la aplicación UniFi Network que \n(i) se ejecutan en una consola UniFi Gateway y \n(ii) son versiones 7.5.176. y antes, \nimplementan la adopción de dispositivos con una lógica de control de acceso inadecuada, creando un riesgo de acceso a la información de configuración del dispositivo por parte de un actor malintencionado con acceso preexistente a la red. Productos afectados: UDM UDM-PRO UDM-SE UDR UDW Mitigación: actualice UniFi Network a la versión 7.5.187 o posterior."
    }
  ],
  "lastModified": "2026-06-17T06:22:41.203",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ui:unifi_network_application:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9E3DE617-CF3A-415A-A504-5735D8FF35E5",
              "versionEndIncluding": "7.5.176"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:ui:unifi_dream_machine:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "33E04DDA-88A0-47C1-8AE2-2F59B1A08BAF"
            },
            {
              "criteria": "cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B493983E-8632-4492-9B0A-E8E11E0E0BB2"
            },
            {
              "criteria": "cpe:2.3:h:ui:unifi_dream_machine_special_edition:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "DEF52155-86F1-458A-8B7E-355B67C5C819"
            },
            {
              "criteria": "cpe:2.3:h:ui:unifi_dream_router:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B1FF6A5E-A223-4F57-9FFD-F2AE473B3627"
            },
            {
              "criteria": "cpe:2.3:h:ui:unifi_dream_wall:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A9B6514E-2878-4AEE-BF1E-08B804C069FE"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "support@hackerone.com"
}