CVE-2023-41721
First published: Wed Oct 25 2023(Updated: )
Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network. Affected Products: UDM UDM-PRO UDM-SE UDR UDW Mitigation: Update UniFi Network to Version 7.5.187 or later.
Credit: support@hackerone.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| Ui Unifi Network Application | <=7.5.176 | |
| Any of | ||
| Ui Unifi Dream Machine | ||
| Ui Unifi Dream Machine Pro | ||
| Ui Unifi Dream Machine Special Edition | ||
| Ui Unifi Dream Router | ||
| Ui Unifi Dream Wall |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-41721?
CVE-2023-41721 is a vulnerability found in instances of UniFi Network Application version 7.5.176 and earlier that allows improper access control, potentially granting unauthorized access to device configuration information.
Which software versions are affected by CVE-2023-41721?
Versions 7.5.176 and earlier of UniFi Network Application are affected by CVE-2023-41721.
What is the severity of CVE-2023-41721?
CVE-2023-41721 has a severity rating of 5.3, which is considered critical.
How does CVE-2023-41721 pose a risk?
CVE-2023-41721 creates a risk of unauthorized access to device configuration information by a malicious actor with preexisting access to UniFi Network Application.
Is there a fix for CVE-2023-41721?
At the moment, there is no known fix for CVE-2023-41721. It is recommended to update to the latest version of UniFi Network Application when a patch becomes available.
- agent/type
- agent/references
- agent/severity
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/weakness
- agent/softwarecombine
- agent/tags
- vendor/ui
- canonical/ui unifi network application
- version/ui unifi network application/7.5.176
- canonical/ui unifi dream machine
- canonical/ui unifi dream machine pro
- canonical/ui unifi dream machine special edition
- canonical/ui unifi dream router
- canonical/ui unifi dream wall