High severity · published Feb 20, 2024
CVE-2024-22054
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery
7.5
CVSS
0.5%
EPSS
No
On KEV
Description
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery.
Affected Products:
UniFi Access Points
UniFi Switches
UniFi LTE Backup
UniFi Express (Only Mesh Mode, Router mode is not affected)
Mitigation:
Update UniFi Access Points to Version 6.6.55 or later.
Update UniFi Switches to Version 6.6.61 or later.
Update UniFi LTE Backup to Version 6.6.57 or later.
Update UniFi Express to Version 3.2.5 or later.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UA
UniFi Access Points · Ubiquiti Inc
6.6.55 before 6.6.55 · source: vendor
UE
UniFi Express · Ubiquiti Inc
3.2.5 before 3.2.5 · source: vendor
UL
UniFi LTE Backup · Ubiquiti Inc
6.6.57 before 6.6.57 · source: vendor
US
UniFi Switches · Ubiquiti Inc
6.6.61 before 6.6.61 · source: vendor
UU
Unifi Uap Firmware · Ubiquiti
before 6.6.55 · source: CISA