Critical severity · published Feb 23, 2023
CVE-2023-24104
Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets
9.8
CVSS
0.8%
EPSS
No
On KEV
Description
Ubiquiti Networks UniFi Dream Machine Pro v7.2.95 allows attackers to bypass domain restrictions via crafted packets.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UD
Unifi Dream Machine Pro Firmware · UI
7.2.95 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24104
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24104
Technical Description
https://attack.mitre.org/techniques/T1090/004/
Exploit
https://github.com/f1veT/BUG/issues/1
More from Unifi Dream Machine Pro Firmware
10.0
CVE-2026-34910
Ubiquiti UniFi OS Improper Input Validation Vulnerability
10.0
CVE-2026-34908
Ubiquiti UniFi OS Improper Access Control Vulnerability
10.0
CVE-2026-34909
Ubiquiti UniFi OS Path Traversal Vulnerability
8.8
CVE-2026-55112
A malicious actor with access to the network and low privileges and under certain conditions could exploit an Improper Access Control vulnerability found in UniFi OS with UniFi…
8.8
CVE-2026-54401
A malicious actor with access to the network and low privileges could exploit a Server-Side Request Forgery (SSRF) to escalate privileges within such UniFi OS devices or instances