CVE-2024-29208: Low severity Ubiquiti UniFi Connect EV Station vulnerability
An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password.
Affected Products:
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29208?
CVE-2024-29208 has been classified as a high severity vulnerability due to the risk of unauthorized password change.
How do I fix CVE-2024-29208?
To fix CVE-2024-29208, upgrade to UniFi Connect EV Station or UniFi Connect EV Station Pro version 1.1.19 or later.
What products are affected by CVE-2024-29208?
CVE-2024-29208 affects UniFi Connect EV Station and UniFi Connect EV Station Pro versions 1.1.18 and earlier.
Can CVE-2024-29208 be exploited remotely?
Yes, CVE-2024-29208 can potentially be exploited remotely by anyone with API access to the device.
What potential impact does CVE-2024-29208 have?
Exploitation of CVE-2024-29208 could lead to unauthorized access and control over the device, risking system integrity and data security.