Unverified Password Change in Ubiquiti Networks products - CVE-2024-29208
Published: July 4, 2024
Vulnerability identifier: #VU93794
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-29208
CWE-ID: CWE-620
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Ubiquiti Networks
Affected software:
UniFi Connect EV Station
UniFi Connect EV Station Pro
UniFi Connect Display
UniFi Connect Display Cast
UniFi Connect Application
UniFi Connect EV Station
UniFi Connect EV Station Pro
UniFi Connect Display
UniFi Connect Display Cast
UniFi Connect Application
Detailed vulnerability description
The vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to lack of proper validation of the old password before setting a new password. A remote administrator can change the system password without knowing the previous password.
How to mitigate CVE-2024-29208
Install updates from vendor's website.