Lucene search

[email protected]NVD:CVE-2023-38034

HistoryAug 10, 2023 - 7:15 p.m.

CVE-2023-38034

2023-08-1019:15:09

CWE-77

[email protected]

web.nvd.nist.gov

cve-2023-38034

dhcp client

remote code execution

affected products

mitigation

unifi

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

68.6%

JSON

A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could allow a Remote Code Execution (RCE).

Affected Products:
All UniFi Access Points (Version 6.5.53 and earlier)
All UniFi Switches (Version 6.5.32 and earlier)
-USW Flex Mini excluded.

Mitigation:
Update UniFi Access Points to Version 6.5.62 or later.
Update UniFi Switches to Version 6.5.59 or later.

Affected configurations

Nvd

Node

uiunifi_uap_firmwareRange≤6.5.53

AND

uiu6\+Match-

uiu6-enterpriseMatch-

uiu6-enterprise-iwMatch-

uiu6-extenderMatch-

uiu6-iwMatch-

uiu6-liteMatch-

uiu6-lrMatch-

uiu6-meshMatch-

uiu6-proMatch-

uiuap-ac-iwMatch-

uiuap-ac-liteMatch-

uiuap-ac-lrMatch-

uiuap-ac-mMatch-

uiuap-ac-m-proMatch-

uiuap-ac-proMatch-

uiubbMatch-

uiubb-xgMatch-

uiuwb-xgMatch-

Node

uiunifi_switch_firmwareRange≤6.5.32

AND

uius-16-150wMatch-

uius-24-250wMatch-

uius-48-500wMatch-

uius-8-150wMatch-

uius-8-60wMatch-

uius-xg-6poeMatch-

uiusw-16-poeMatch-

uiusw-24Match-

uiusw-24-poeMatch-

uiusw-48Match-

uiusw-48-poeMatch-

uiusw-aggregationMatch-

uiusw-enterprise-24-poeMatch-

uiusw-enterprise-48-poeMatch-

uiusw-enterprise-8-poeMatch-

uiusw-enterprisexg-24Match-

uiusw-flexMatch-

uiusw-flex-xgMatch-

uiusw-industrialMatch-

uiusw-lite-16-poeMatch-

uiusw-lite-8-poeMatch-

uiusw-mission-criticalMatch-

uiusw-pro-24Match-

uiusw-pro-24-poeMatch-

uiusw-pro-48Match-

uiusw-pro-48-poeMatch-

uiusw-pro-aggregationMatch-

VendorProductVersionCPE
uiunifi_uap_firmware*cpe:2.3:o:ui:unifi_uap_firmware:*:*:*:*:*:*:*:*
uiu6\+-cpe:2.3:h:ui:u6\+:-:*:*:*:*:*:*:*
uiu6-enterprise-cpe:2.3:h:ui:u6-enterprise:-:*:*:*:*:*:*:*
uiu6-enterprise-iw-cpe:2.3:h:ui:u6-enterprise-iw:-:*:*:*:*:*:*:*
uiu6-extender-cpe:2.3:h:ui:u6-extender:-:*:*:*:*:*:*:*
uiu6-iw-cpe:2.3:h:ui:u6-iw:-:*:*:*:*:*:*:*
uiu6-lite-cpe:2.3:h:ui:u6-lite:-:*:*:*:*:*:*:*
uiu6-lr-cpe:2.3:h:ui:u6-lr:-:*:*:*:*:*:*:*
uiu6-mesh-cpe:2.3:h:ui:u6-mesh:-:*:*:*:*:*:*:*
uiu6-pro-cpe:2.3:h:ui:u6-pro:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ui	unifi_uap_firmware	*	cpe:2.3:o:ui:unifi_uap_firmware::::::::
ui	u6\+	-	cpe:2.3:h:ui:u6\+:-:::::::*
ui	u6-enterprise	-	cpe:2.3:h:ui:u6-enterprise:-:::::::*
ui	u6-enterprise-iw	-	cpe:2.3:h:ui:u6-enterprise-iw:-:::::::*
ui	u6-extender	-	cpe:2.3:h:ui:u6-extender:-:::::::*
ui	u6-iw	-	cpe:2.3:h:ui:u6-iw:-:::::::*
ui	u6-lite	-	cpe:2.3:h:ui:u6-lite:-:::::::*
ui	u6-lr	-	cpe:2.3:h:ui:u6-lr:-:::::::*
ui	u6-mesh	-	cpe:2.3:h:ui:u6-mesh:-:::::::*
ui	u6-pro	-	cpe:2.3:h:ui:u6-pro:-:::::::*

Rows per page:

1-10 of 471

References

community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-9884-44df-b1c6-63c6499f6e56

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

AI Score

9.3

Confidence

High

EPSS

0.003

Percentile

68.6%

JSON

Related for NVD:CVE-2023-38034

prion1 cvelist1 cve1