Riskcovery

CVE-2024-29206

State
Published
Severity
2.2 Low
Published
May 7, 2024
Updated
Aug 2, 2024
Reserved
Mar 19, 2024

Read the record on cve.org

Description

An Improper Access Control could allow a malicious actor authenticated in the API to enable Android Debug Bridge (ADB) and make unsupported changes to the system.

Affected Products:

UniFi Connect EV Station (Version 1.1.18 and earlier)

UniFi Connect EV Station Pro (Version 1.1.18 and earlier)

UniFi Access G2 Reader Pro (Version 1.2.172 and earlier)

UniFi Access Reader Pro (Version 2.7.238 and earlier)

UniFi Access Intercom (Version 1.0.66 and earlier)

UniFi Access Intercom Viewer (Version 1.0.5 and earlier)

UniFi Connect Display (Version 1.9.324 and earlier)

UniFi Connect Display Cast (Version 1.6.225 and earlier)

Mitigation:

Update UniFi Connect Application to Version 3.10.7 or later.

Update UniFi Connect EV Station to Version 1.2.15 or later.

Update UniFi Connect EV Station Pro to Version 1.2.15 or later.

Update UniFi Access G2 Reader Pro Version 1.3.37 or later.

Update UniFi Access Reader Pro Version 2.8.19 or later.

Update UniFi Access Intercom Version 1.1.32 or later.

Update UniFi Access Intercom Viewer Version 1.1.6 or later.

Update UniFi Connect Display to Version 1.11.348 or later.

Update UniFi Connect Display Cast to Version 1.8.255 or later.

Scores

CVSSScoreVectorSource
3.02.2 LowCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:Nhackerone

Weaknesses

Affected Products

ProductVersions
UniFi Connect EV StationUbiquiti Inc
  • 1.2.15 to before 1.2.15Affected
UniFi Connect EV Station ProUbiquiti Inc
  • 1.2.15 to before 1.2.15Affected
UniFi Access G2 Reader ProUbiquiti Inc
  • 1.3.37 to before 1.3.37Affected
UniFi Access Reader ProUbiquiti Inc
  • 2.8.19 to before 2.8.19Affected
UniFi Access IntercomUbiquiti Inc
  • 1.1.32 to before 1.1.32Affected
UniFi Access Intercom ViewerUbiquiti Inc
  • 1.1.6 to before 1.1.6Affected
UniFi Connect DisplayUbiquiti Inc
  • 1.11.348 to before 1.11.348Affected
UniFi Connect Display CastUbiquiti Inc
  • 1.8.255 to before 1.8.255Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.