Massive security flaws plague Ubiquiti’s UniFi ecosystem: 22 vulnerabilities, 21 critical

Ubiquiti has issued a major security warning – 21 vulnerabilities of maximum or near-maximum severity affect its UniFi ecosystem. Attackers can gain complete control: remotely bypass authentication, escalate privileges, and run arbitrary commands on the affected software and UniFi devices, including gateways, NAS devices, video security NVRs, and more.

The new security advisory includes 22 vulnerabilities in total, with a striking ratio: 21 bugs are rated Critical, each with a score of 9.0 or higher on the Common Vulnerability Scoring System (CVSS) scale.

UniFi OS – the core operating system behind the ecosystem that powers a broad range of products – is itself critically vulnerable, and it is as bad as it gets.

All the attackers need to compromise the systems is network access – no privileges, no user interaction, and the attack complexity is low.

A potential cyberattack would affect basically the entire UniFi OS hardware line: Cloud Keys, Network Video Recorders, Enterprise Network Video Recorders, Enterprise Network Attached Storage, Network Attached Storage, Dream Machines, Enterprise Firewall Core, Dream Routers, Enterprise Fortress Gateway, Cloud Gateways, Dream Wall, Express 7, and more.

“A malicious actor with access to the network could exploit an Improper Neutralization of CRLF Sequences vulnerability found in certain devices running UniFi OS to bypass authentication to such UniFi OS devices or instances,” the description of one of the “perfect” vulnerabilities reads in the advisory.

Two other OS-wide bugs, rated 9.9 out of 10, allow low-privileged network attackers to escalate to full control.

A “perfect 10” bug affects the UniFi Protect Application, allowing attackers to execute injected commands without authentication or privileges. A separate bug allows full control for low-privileged attackers. UniFi Protect is Ubiquiti’s video surveillance and security management platform.

UniFi Talk, a Voice over IP (VoIP) phone system, also contains a 10 out of 10 bug that enables hackers with network access to exploit an Improper Input Validation vulnerability and execute arbitrary commands.

Many other critical vulnerabilities allow attackers to elevate privileges, gain full control of devices, and potentially control any apps running on them or elsewhere on the network.

Ubiquiti hasn’t yet flagged any active exploitation of the bugs, but threat actors are likely to move quickly to exploit them. The vendor urges immediate updates to all affected software and devices, with UniFi OS Server as a top priority.

Some of the most severe other bugs include:

• UniFi Enterprise Audio/Video Bridge is affected by a 9.8 out of 10 unauthenticated command injection bug.
• The UniFi Access Application, which handles building door controls and physical security, is affected by four vulnerabilities, all of which allow a low-privileged malicious actor to escalate privileges on the host device.
• A higher-complexity authentication bypass via CRLF bug that affects UniFi OS-wide, rated 9 out of 10.
• UniFi OS is also affected by the Active Debug Code vulnerability, which enables privilege escalation under certain conditions.
• UniFi Connect Display Cast Pro, a hardware media player that transforms monitors into centrally managed digital signage screens, contains a critical privilege escalation vulnerability.

While Ubiquiti has disclosed critical vulnerabilities in previous advisories this year, some of which were already exploited in the wild and added to CISA's Known Exploited Vulnerabilities catalog, the new advisory contains the most critical bugs.

Several external researchers were credited for discovering the flaws.