CVE-2016-6914 Privilege escalation in n/a
Local attackers can gain SYSTEM privileges by placing a malicious taskkill.exe in the weakly protected installation directory of UniFi Video for Windows.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2016-6914?
CVE-2016-6914 is a high-severity vulnerability in n/a, published on 27 Dec 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local users to gain SYSTEM privileges via a Trojan horse taskkill.exe file.
Weakness: CWE-276
Which versions are affected by CVE-2016-6914?
It affects 1 product.
Products include Ui Unifi Video.
How do I fix CVE-2016-6914?
No fix has been published for CVE-2016-6914 yet. Limit exposure of the affected software until one is available.
Is CVE-2016-6914 being exploited?
There is no known exploitation of CVE-2016-6914 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 1 proofs of concept on GitHub.
Other vulnerabilities in n/a
- CVE-2019-5430 Cross-site request forgery in UniFi Video Server
- CVE-2020-8144 Path traversal in UniFi Video Controller (for Windows 7/8/10 x64)
- CVE-2020-24755 Other in n/a
- CVE-2020-8146 Privilege escalation in UniFi Video Controller (for Windows 7/8/10 x64)
- CVE-2020-8145 Missing authorization in UniFi Video Controller (for Windows 7/8/10 x64)
Sources
Also known as GHSA-m6qh-7ffq-jg2w.