Ubiquiti UI Desktop up to 0.59.1.71 on Windows Configuration File inadequate encryption

Summaryinfo

A vulnerability categorized as problematic has been discovered in Ubiquiti UI Desktop up to 0.59.1.71 on Windows. Affected by this vulnerability is an unknown functionality of the component Configuration File Handler. Executing a manipulation can lead to inadequate encryption. The identification of this vulnerability is CVE-2023-28124. There is no exploit available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic was found in Ubiquiti UI Desktop up to 0.59.1.71 on Windows. This vulnerability affects an unknown functionality of the component Configuration File Handler. The manipulation with an unknown input leads to a inadequate encryption vulnerability. The CWE definition for the vulnerability is CWE-326. The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required. As an impact it is known to affect confidentiality. CVE summarizes:

Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI Desktop configuration files to decrypt their content.This vulnerability is fixed in Version 0.62.3 and later.

The weakness was shared 04/20/2023. The advisory is shared for download at community.ui.com. This vulnerability was named CVE-2023-28124 since 03/10/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.

Upgrading to version 0.62.3 eliminates this vulnerability. The upgrade is hosted for download at community.ui.com.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2023-31835). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Ubiquiti

Name

• UI Desktop

Version

• 0.59.1.0
• 0.59.1.1
• 0.59.1.2
• 0.59.1.3
• 0.59.1.4
• 0.59.1.5
• 0.59.1.6
• 0.59.1.7
• 0.59.1.8
• 0.59.1.9
• 0.59.1.10
• 0.59.1.11
• 0.59.1.12
• 0.59.1.13
• 0.59.1.14
• 0.59.1.15
• 0.59.1.16
• 0.59.1.17
• 0.59.1.18
• 0.59.1.19
• 0.59.1.20
• 0.59.1.21
• 0.59.1.22
• 0.59.1.23
• 0.59.1.24
• 0.59.1.25
• 0.59.1.26
• 0.59.1.27
• 0.59.1.28
• 0.59.1.29
• 0.59.1.30
• 0.59.1.31
• 0.59.1.32
• 0.59.1.33
• 0.59.1.34
• 0.59.1.35
• 0.59.1.36
• 0.59.1.37
• 0.59.1.38
• 0.59.1.39
• 0.59.1.40
• 0.59.1.41
• 0.59.1.42
• 0.59.1.43
• 0.59.1.44
• 0.59.1.45
• 0.59.1.46
• 0.59.1.47
• 0.59.1.48
• 0.59.1.49
• 0.59.1.50
• 0.59.1.51
• 0.59.1.52
• 0.59.1.53
• 0.59.1.54
• 0.59.1.55
• 0.59.1.56
• 0.59.1.57
• 0.59.1.58
• 0.59.1.59
• 0.59.1.60
• 0.59.1.61
• 0.59.1.62
• 0.59.1.63
• 0.59.1.64
• 0.59.1.65
• 0.59.1.66
• 0.59.1.67
• 0.59.1.68
• 0.59.1.69
• 0.59.1.70
• 0.59.1.71

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion