Improper Certificate Validation in Ubiquiti Networks products - CVE-2024-29207

Vulnerability identifier: #VU93793

CSH Severity: Medium

CVSS v4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-29207

CWE-ID: CWE-295

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to improper server certificate verification within the EVCLauncher application. A remote attacker on the local network can take control of the system.

UniFi Connect Application
UniFi Connect EV Station
UniFi Connect EV Station Pro
UniFi Connect Display
UniFi Connect Display Cast

Install updates from vendor's website.

UniFi Connect Application - update to 3.10.7
UniFi Connect EV Station - update to 1.2.15
UniFi Connect EV Station Pro - update to 1.2.15
UniFi Connect Display - update to 1.11.348
UniFi Connect Display Cast - update to 1.8.255

• https://community.ui.com/releases/Security-Advisory-bulletin-039-039/44e24007-2c2c-4ac0-bebf-3f19b9b24f09
• https://www.zerodayinitiative.com/advisories/ZDI-24-880/

• Multiple vulnerabilities in Ubiquiti Networks products