CVE-2018-5264: Medium severity ui unifi uap firmware vulnerability

Published Jun 7, 2019

Updated

Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on "free time" Wi-Fi usage by sending a /guest/s/default/ request to obtain a cookie, and then using this cookie in a /guest/s/default/login request with the byfree parameter.

Affected Software

2 affected components

UI Unifi Firmware

UI UniFi 52

Event History

Jun 7, 2019

CVE Published

via MITRE·03:26 PM

Data Sourced

via MITRE·03:26 PM

Description

Frequently Asked Questions

What is CVE-2018-5264?

CVE-2018-5264 is a vulnerability that affects Ubiquiti UniFi 52 devices, allowing remote attackers to bypass intended restrictions on 'free time' Wi-Fi usage.

What is the severity of CVE-2018-5264?

CVE-2018-5264 has a severity score of 5.9, which is considered medium.

How do attackers bypass the intended restrictions on 'free time' Wi-Fi usage?

Attackers can bypass the intended restrictions by sending a /guest/s/default/ request to obtain a cookie, and then using this cookie in a /guest/s/default/login request with the byfree parameter.

Which devices are affected by CVE-2018-5264?

Ubiquiti UniFi 52 devices are affected by CVE-2018-5264 when Hotspot mode is used.

Is Ubiquiti UniFi 52 vulnerable to CVE-2018-5264?

No, Ubiquiti UniFi 52 devices are not vulnerable to CVE-2018-5264.

How can I fix CVE-2018-5264?

Currently, there is no known fix or patch available for CVE-2018-5264. It is recommended to stay updated with the latest firmware and follow any vendor advisories.