CVE-2020-8267 Auth bypass in UniFi Protect
Attackers can bypass authentication in the UniFi Protect controller API by improperly using the x-token header, allowing unauthorized access to authenticated messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-8267?
CVE-2020-8267 is a medium-severity authentication bypass vulnerability in UniFi Protect, published on 5 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A security issue was found in UniFi Protect controller v1.14.10 and earlier.The authentication in the UniFi Protect controller API was using “x-token” improperly, allowing attackers to use the API to send authenticated messages without a valid token.This vulnerability was fixed in UniFi Protect v1.14.11 and newer.This issue does not impact UniFi Cloud Key Gen 2 plus.This issue does not impact UDM-Pro customers with UniFi Protect stopped.Affected Products:UDM-Pro firmware 1.7.2 and earlier.UNVR firmware 1.3.12 and earlier.Mitigation:Update UniFi Protect to v1.14.11 or newer version; the UniFi Protect controller can be updated through your UniFi OS settings.Alternatively, you can update UNVR and UDM-Pro to:- UNVR firmware to 1.3.15 or newer.- UDM-Pro firmware to 1.8.0 or newer.
Weakness: CWE-287
Which versions are affected by CVE-2020-8267?
It affects 1 product.
Products include Ui Unifi Protect Firmware.
How do I fix CVE-2020-8267?
No fix has been published for CVE-2020-8267 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-8267 being exploited?
There is no known exploitation of CVE-2020-8267 in the wild and no public exploit code.
Other vulnerabilities in UniFi Protect
Sources
Also known as GHSA-qhjp-4vc3-896g.