CVE-2020-8148 - UniFi Cloud Key firmware < 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request

Back Back to CVE browser

MEDIUM

UniFi Cloud Key firmware < 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request

Published Apr 13, 2020

5.3

MEDIUM

CVSS 3.1

EPSS 1.05%

Description

UniFi Cloud Key firmware < 1.1.6 contains a vulnerability that enables an attacker being able to change a device hostname by sending a malicious API request. This affects Cloud Key gen2 and Cloud Key gen2 Plus.

Affected products

Vendor n/a Product UniFi Cloud Key Gen2 Default
n/a
- Version
  Fixed in firmware >= 1.1.10
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

UniFi Cloud Key Gen2

n/a

Version	Status	Constraints
Fixed in firmware >= 1.1.10	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-287

Improper Authentication

References (3)

https://community.ui.com/releases/Security-advisory-bulletin-007-007/eb639fa0-68ad-4bf5-9663-3b760eb2f93a
x_refsource_MISCPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29043
Advisory
https://hackerone.com/reports/802079
x_refsource_MISCIssue TrackingThird Party Advisory

Link	Providers	Tags
https://community.ui.com/releases/Security-advisory-bulletin-007-007/eb639fa0-68ad-4bf5-9663-3b760eb2f93a		x_refsource_MISCPatchVendor Advisory
https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-29043		Advisory
https://hackerone.com/reports/802079		x_refsource_MISCIssue TrackingThird Party Advisory