Description Preview
Overview
CVE-2020-8267 is an improper authentication vulnerability (CWE-287) affecting the UniFi Protect controller API. The issue stems from incorrect implementation of the "x-token" authentication mechanism, which allows attackers to bypass authentication controls and send authenticated API requests without possessing a valid token. This vulnerability impacts UDM-Pro devices running firmware 1.7.2 and earlier, and UNVR devices running firmware 1.3.12 and earlier. The vulnerability does not affect UniFi Cloud Key Gen 2 Plus devices or UDM-Pro customers who have UniFi Protect stopped. Successful exploitation could allow unauthorized access to camera feeds, recordings, and system configuration.
Remediation
To address this vulnerability, administrators should implement one of the following solutions:
-
Update UniFi Protect to version 1.14.11 or newer through the UniFi OS settings interface.
-
Alternatively, update the firmware on affected devices:
- For UNVR devices: Update to firmware version 1.3.15 or newer
- For UDM-Pro devices: Update to firmware version 1.8.0 or newer
If immediate updates are not possible, consider temporarily disabling the UniFi Protect service on UDM-Pro devices until updates can be applied.
References
-
UniFi Dream Machine Firmware 1.8.0 Release Notes: https://community.ui.com/releases/UniFi-Dream-Machine-Firmware-1-8-0/deabc255-a081-49ba-8f51-131f3a13000a
-
UniFi Protect 1.14.11 Release Notes: https://community.ui.com/releases/UniFi-Protect-1-14-11/928e6fac-afeb-49c2-93a5-1b3066bf2bbf
-
UniFi Protect NVR Firmware 1.3.15 Release Notes: https://community.ui.com/releases/UniFi-Protect-NVR-Firmware-1-3-15/c2a783a6-c996-43d9-ab95-8c97ae05a98f
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- Accommodation & Food ServicesAccommodation & Food Services
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- ConstructionConstruction
- Educational ServicesEducational Services
- Finance and InsuranceFinance and Insurance
- Health Care & Social AssistanceHealth Care & Social Assistance
- InformationInformation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- ManufacturingManufacturing
- MiningMining
- Other Services (except Public Administration)Other Services (except Public Administration)
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Public AdministrationPublic Administration
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Retail TradeRetail Trade
- Transportation & WarehousingTransportation & Warehousing
- UtilitiesUtilities
- Wholesale TradeWholesale Trade
