Low severity · published May 7, 2024
CVE-2024-29208
An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password
2.2
CVSS
0.3%
EPSS
No
On KEV
Description
An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password.
Affected Products:
UniFi Connect EV Station (Version 1.1.18 and earlier)
UniFi Connect EV Station Pro (Version 1.1.18 and earlier)
UniFi Connect Display (Version 1.9.324 and earlier)
UniFi Connect Display Cast (Version 1.6.225 and earlier)
Mitigation:
Update UniFi Connect Application to Version 3.10.7 or later.
Update UniFi Connect EV Station to Version 1.2.15 or later.
Update UniFi Connect EV Station Pro to Version 1.2.15 or later.
Update UniFi Connect Display to Version 1.11.348 or later.
Update UniFi Connect Display Cast to Version 1.8.255 or later.
CVSS vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 28% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UU
Update UniFi Connect Display · Ubiquiti Inc
1.11.348 before 1.11.348 · source: vendor
UU
Update UniFi Connect Display Cast · Ubiquiti Inc
1.8.255 before 1.8.255 · source: vendor
UU
Update UniFi Connect EV Station · Ubiquiti Inc
1.2.15 before 1.2.15 · source: vendor
UU
Update UniFi Connect EV Station Pro · Ubiquiti Inc
1.2.15 before 1.2.15 · source: vendor
UC
Unifi Connect Display · Ubiquiti
1.11.348 · source: CISA
UC
Unifi Connect Display Cast · Ubiquiti
1.8.255 · source: CISA
UC
Unifi Connect EV Station · Ubiquiti
1.2.15 · source: CISA
UC
Unifi Connect EV Station Pro · Ubiquiti
1.2.15 · source: CISA