CVE-2020-8188: OS Command Injection

Q: What is CVE-2020-8188?

CVE-2020-8188 is a vulnerability in UniFi Protect firmware v1.13.2 and v1.14.9 and prior versions that allows view only users to run unauthorized commands.

Q: How severe is CVE-2020-8188?

CVE-2020-8188 has a severity score of 8.8, which is considered high.

Q: Which software versions are affected by CVE-2020-8188?

UniFi Protect firmware v1.13.2 and v1.14.9 and prior versions are affected by CVE-2020-8188.

Q: How can I fix CVE-2020-8188?

To fix CVE-2020-8188, update your UniFi Protect firmware to v1.13.3 or v1.14.10.

Q: Are UniFi Cloud Key Plus and UniFi Dream Machine Pro affected by CVE-2020-8188?

No, UniFi Cloud Key Plus and UniFi Dream Machine Pro are not affected by CVE-2020-8188.

Published Jul 2, 2020

Updated

We have recently released new version of UniFi Protect firmware v1.13.3 and v1.14.10 for Unifi Cloud Key Gen2 Plus and UniFi Dream Machine Pro/UNVR respectively that fixes vulnerabilities found on Protect firmware v1.13.2, v1.14.9 and prior according to the description below:View only users can run certain custom commands which allows them to assign themselves unauthorized roles and escalate their privileges.

Affected Software

5 affected components

UI Unifi Protect Firmware<=1.13.2

UI Unifi Protect

UI Unifi Protect Firmware<=1.14.9

UI Unifi Cloud Key Plus

UI UniFi Dream Machine Pro

Event History

Jul 2, 2020

CVE Published

via MITRE·06:35 PM

Data Sourced

via MITRE·06:35 PM

DescriptionWeakness

Frequently Asked Questions

What is CVE-2020-8188?

CVE-2020-8188 is a vulnerability in UniFi Protect firmware v1.13.2 and v1.14.9 and prior versions that allows view only users to run unauthorized commands.

How severe is CVE-2020-8188?

CVE-2020-8188 has a severity score of 8.8, which is considered high.

Which software versions are affected by CVE-2020-8188?