Unscored severity · published Jul 29, 2014
CVE-2014-2226
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via…
–
CVSS
1.5%
EPSS
No
On KEV
Description
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.5% · higher than 73% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UC
Unifi Controller · UI
through 2.4.6 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-2226
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-2226
packetstormsecurity.com
http://packetstormsecurity.com/files/127616/Ubiquiti-UbiFi-Controller-2.4.5-Password-Hash-Disclosure.html
seclists.org
http://seclists.org/fulldisclosure/2014/Jul/127
sethsec.blogspot.com
http://sethsec.blogspot.com/2014/07/cve-2014-2226.html
www.securityfocus.com
http://www.securityfocus.com/bid/68869
More from Unifi Controller
8.8
CVE-2014-2225
Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of administrators…
8.1
CVE-2019-5456
SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP server to record their SMTP credentials…
7.5
CVE-2020-12695
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment…
6.1
CVE-2013-3572
Cross-site scripting (XSS) vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject…