Ubiquiti M365 1.3.3 Admin Interface pingtest_action.cgi privileges management

Summaryinfo

A vulnerability classified as problematic has been found in Ubiquiti TS-16-CARRIER, TS-5-POE, TS-8-PRO, AG-HP-2G16, AG-HP-2G20, AG-HP-5G23, AG-HP-5G27, AirGrid M, AirGrid M2, AirGrid M5, AR, AR-HP, BM2HP, BM2-Ti, BM5HP, BM5-Ti, LiteStation M5, locoM2, locoM5, locoM9, M2, M3 and M365 1.3.3. This affects an unknown function of the file pingtest_action.cgi of the component Admin Interface. The manipulation leads to privileges management. It is possible to initiate the attack remotely. Furthermore, there is an exploit available.

Detailsinfo

A vulnerability was found in Ubiquiti TS-16-CARRIER, TS-5-POE, TS-8-PRO, AG-HP-2G16, AG-HP-2G20, AG-HP-5G23, AG-HP-5G27, AirGrid M, AirGrid M2, AirGrid M5, AR, AR-HP, BM2HP, BM2-Ti, BM5HP, BM5-Ti, LiteStation M5, locoM2, locoM5, locoM9, M2, M3 and M365 1.3.3. It has been rated as problematic. This issue affects some unknown processing of the file pingtest_action.cgi of the component Admin Interface. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability.

The weakness was shared 03/16/2017 by T. Weber with SEC Consult Vulnerability Lab as SEC Consult SA-20170316-0 :: Authenticated command injection in multiple Ubiquiti Networks products as not defined mailinglist post (Full-Disclosure). The advisory is shared at seclists.org. The attack may be initiated remotely. Technical details as well as a public exploit are known. MITRE ATT&CK project uses the attack technique T1068 for this issue.

A public exploit has been developed by T. Weber and been published immediately after the advisory. The exploit is available at seclists.org. It is declared as proof-of-concept.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Vendor

• Ubiquiti

Name

• AG-HP-2G16
• AG-HP-2G20
• AG-HP-5G23
• AG-HP-5G27
• AirGrid M
• AirGrid M2
• AirGrid M5
• AR
• AR-HP
• BM2-Ti
• BM2HP
• BM5-Ti
• BM5HP
• LiteStation M5
• locoM2
• locoM5
• locoM9
• M2
• M3
• M365
• TS-5-POE
• TS-8-PRO
• TS-16-CARRIER

Version

• 1.3.3

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

Video

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion