#VU93794 Unverified Password Change in Ubiquiti Networks products - CVE-2024-29208
Published: July 4, 2024
Vulnerability identifier: #VU93794
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2024-29208
CWE-ID: CWE-620
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
UniFi Connect EV Station
UniFi Connect EV Station Pro
UniFi Connect Display
UniFi Connect Display Cast
UniFi Connect Application
UniFi Connect EV Station
UniFi Connect EV Station Pro
UniFi Connect Display
UniFi Connect Display Cast
UniFi Connect Application
Software vendor:
Ubiquiti Networks
Ubiquiti Networks
Description
The vulnerability allows a remote user to compromise the target system.
The vulnerability exists due to lack of proper validation of the old password before setting a new password. A remote administrator can change the system password without knowing the previous password.
Remediation
Install updates from vendor's website.