CVE-2024-22054: Input Validation
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.
Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express (Only Mesh Mode, Router mode is not affected)
Mitigation: Update UniFi Access Points to Version 6.6.55 or later. Update UniFi Switches to Version 6.6.61 or later. Update UniFi LTE Backup to Version 6.6.57 or later. Update UniFi Express to Version 3.2.5 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
UniFi Access Pointsto a version that resolves this vulnerability.Fixed in 6.6.55 - Upgrade
Upgrade
UniFi Expressto a version that resolves this vulnerability.Fixed in 3.2.5 - Upgrade
Upgrade
UniFi LTE Backupto a version that resolves this vulnerability.Fixed in 6.6.57 - Upgrade
Upgrade
UniFi Switchesto a version that resolves this vulnerability.Fixed in 6.6.61
Event History
Frequently Asked Questions
What is the severity of CVE-2024-22054?
CVE-2024-22054 is considered a critical vulnerability that can disrupt device management and discovery.
How do I fix CVE-2024-22054?
To fix CVE-2024-22054, users should update their affected Ubiquiti products to the latest firmware versions specified by the vendor.
Which devices are affected by CVE-2024-22054?
CVE-2024-22054 affects Ubiquiti UniFi Access Points, UniFi Switches, UniFi LTE Backup, and UniFi Express in Mesh Mode.
What are the potential impacts of CVE-2024-22054?
The potential impacts of CVE-2024-22054 include interruption of device management and loss of discovery functionality.
Can CVE-2024-22054 be exploited remotely?
CVE-2024-22054 requires a malicious actor to have preexisting access to the network to exploit the vulnerability.