CVE-2024-29206
Status: DeferredLow (2.2)—
An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.
Affected Products:
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Access G2 Reader Pro (Version 1.2.172 and earlier)
UniFi Access Reader Pro (Version 2.7.238 and earlier)
UniFi Access Intercom (Version 1.0.66 and earlier)
UniFi Access Intercom Viewer (Version 1.0.5 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Read full descriptionShow less
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Access G2 Reader Pro Version 1.3.37 or later.
Update UniFi Access Reader Pro Version 2.8.19 or later.
Update UniFi Access Intercom Version 1.1.32 or later.
Update UniFi Access Intercom Viewer Version 1.1.6 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
CVSS
- Version: 3.0
- Vector: CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
- Base score: 2.2
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 0.44%
- Percentile among all scored CVEs: 36
- Score date: 10/5/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (8)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
CWEs
- CWE-284
References
Raw JSON (NVD)
Show
{
"id": "CVE-2024-29206",
"cveTags": [],
"metrics": {
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2024-29206",
"role": "CISA Coordinator",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2024-05-08T15:33:56.493181Z"
}
}
],
"cvssMetricV30": [
{
"type": "Secondary",
"source": "support@hackerone.com",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.0",
"baseScore": 2.2,
"attackVector": "NETWORK",
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "HIGH",
"availabilityImpact": "NONE",
"privilegesRequired": "HIGH",
"confidentialityImpact": "NONE"
},
"impactScore": 1.4,
"exploitabilityScore": 0.7
}
]
},
"affected": [
{
"source": "support@hackerone.com",
"affectedData": [
{
"vendor": "Ubiquiti Inc",
"product": "UniFi Connect EV Station",
"versions": [
{
"status": "affected",
"version": "1.2.15",
"lessThan": "1.2.15",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "UniFi Connect EV Station Pro",
"versions": [
{
"status": "affected",
"version": "1.2.15",
"lessThan": "1.2.15",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "UniFi Access G2 Reader Pro ",
"versions": [
{
"status": "affected",
"version": "1.3.37",
"lessThan": "1.3.37",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "UniFi Access Reader Pro ",
"versions": [
{
"status": "affected",
"version": "2.8.19",
"lessThan": "2.8.19",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "UniFi Access Intercom",
"versions": [
{
"status": "affected",
"version": "1.1.32",
"lessThan": "1.1.32",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "UniFi Access Intercom Viewer",
"versions": [
{
"status": "affected",
"version": "1.1.6",
"lessThan": "1.1.6",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "UniFi Connect Display",
"versions": [
{
"status": "affected",
"version": "1.11.348",
"lessThan": "1.11.348",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
},
{
"vendor": "Ubiquiti Inc",
"product": "UniFi Connect Display Cast ",
"versions": [
{
"status": "affected",
"version": "1.8.255",
"lessThan": "1.8.255",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
]
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"affectedData": [
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station:1.2.15:*:*:*:*:*:*:*"
],
"vendor": "ubiquiti",
"product": "unifi_connect_ev_station",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_g2_reader_pro:*:*:*:*:*:*:*:*"
],
"vendor": "ubiquiti",
"product": "unifi_access_g2_reader_pro",
"versions": [
{
"status": "affected",
"version": "1.3.37"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display:1.11.348:*:*:*:*:*:*:*"
],
"vendor": "ubiquiti",
"product": "unifi_connect_display",
"versions": [
{
"status": "affected",
"version": "1.11.348"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_display_cast:1.8.255:*:*:*:*:*:*:*"
],
"vendor": "ubiquiti",
"product": "unifi_connect_display_cast",
"versions": [
{
"status": "affected",
"version": "1.8.255"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_reader_pro:*:*:*:*:*:*:*:*"
],
"vendor": "ubiquiti",
"product": "unifi_access_reader_pro",
"versions": [
{
"status": "affected",
"version": "2.8.19"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom:*:*:*:*:*:*:*:*"
],
"vendor": "ubiquiti",
"product": "unifi_access_intercom",
"versions": [
{
"status": "affected",
"version": "1.1.32"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_access_intercom_viewer:*:*:*:*:*:*:*:*"
],
"vendor": "ubiquiti",
"product": "unifi_access_intercom_viewer",
"versions": [
{
"status": "affected",
"version": "1.1.6"
}
],
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:2.3:a:ubiquiti:unifi_connect_ev_station_pro:1.2.15.0:*:*:*:*:*:*:*"
],
"vendor": "ubiquiti",
"product": "unifi_connect_ev_station_pro",
"versions": [
{
"status": "affected",
"version": "1.2.15"
}
],
"defaultStatus": "unknown"
}
]
}
],
"published": "2024-05-07T17:15:08.027",
"references": [
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09",
"source": "support@hackerone.com"
},
{
"url": "https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Deferred",
"weaknesses": [
{
"type": "Secondary",
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"description": [
{
"lang": "en",
"value": "CWE-284"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.\n\n \n\nAffected Products:\n\nUniFi Connect EV Station (Version 1.1.18 and earlier) \n\nUniFi Connect EV Station Pro (Version 1.1.18 and earlier)\n\nUniFi Access G2 Reader Pro (Version 1.2.172 and earlier)\n\nUniFi Access Reader Pro (Version 2.7.238 and earlier)\n\nUniFi Access Intercom (Version 1.0.66 and earlier)\n\nUniFi Access Intercom Viewer (Version 1.0.5 and earlier)\n\nUniFi Connect Display (Version 1.9.324 and earlier)\n\nUniFi Connect Display Cast (Version 1.6.225 and earlier)\n\n \n\nMitigation:\n\nUpdate UniFi Connect Application to Version 3.10.7 or later.\n\nUpdate UniFi Connect EV Station to Version 1.2.15 or later. \n\nUpdate UniFi Connect EV Station Pro to Version 1.2.15 or later.\n\nUpdate UniFi Access G2 Reader Pro Version 1.3.37 or later.\n\nUpdate UniFi Access Reader Pro Version 2.8.19 or later.\n\nUpdate UniFi Access Intercom Version 1.1.32 or later.\n\nUpdate UniFi Access Intercom Viewer Version 1.1.6 or later.\n\nUpdate UniFi Connect Display to Version 1.11.348 or later. \n\nUpdate UniFi Connect Display Cast to Version 1.8.255 or later."
},
{
"lang": "es",
"value": "Un control de acceso inadecuado podría permitir que un actor malicioso autenticado en la API habilite Android Debug Bridge (ADB) y realice cambios no compatibles en el sistema. Productos afectados: UniFi Connect EV Station (versión 1.1.18 y anteriores) UniFi Connect EV Station Pro (versión 1.1.18 y anteriores) UniFi Access G2 Reader Pro (versión 1.2.172 y anteriores) UniFi Access Reader Pro (versión 2.7.238 y anteriores) UniFi Access Intercom (versión 1.0.66 y anteriores) UniFi Access Intercom Viewer (versión 1.0.5 y anteriores) UniFi Connect Display (versión 1.9.324 y anteriores) UniFi Connect Display Cast (versión 1.6.225 y anteriores) Mitigación : Actualice la aplicación UniFi Connect a la versión 3.10.7 o posterior. Actualice UniFi Connect EV Station a la versión 1.2.15 o posterior. Actualice UniFi Connect EV Station Pro a la versión 1.2.15 o posterior. Actualice UniFi Access G2 Reader Pro versión 1.3.37 o posterior. Actualice UniFi Access Reader Pro versión 2.8.19 o posterior. Actualice UniFi Access Intercom versión 1.1.32 o posterior. Actualice UniFi Access Intercom Viewer versión 1.1.6 o posterior. Actualice UniFi Connect Display a la versión 1.11.348 o posterior. Actualice UniFi Connect Display Cast a la versión 1.8.255 o posterior."
}
],
"lastModified": "2026-06-17T07:22:37.683",
"sourceIdentifier": "support@hackerone.com"
}