Ubiquiti Inc. · Report #183458
Command injection in the process of downloading the latest version of the cloud key firmware through the unifi management software.
Validstatus
highseverity
7upvotes
11 Dec 2017disclosed
Summary
In UniFi Cloud Key versions prior to 5.3.12, 5.4.9 and 5.5.2, the firmware is downloaded in a unprotected channel, with allow an attacker in an MitM scenario to interfere with the communication, and possibly modifying the firmware during an update. The versions 5.3.12, 5.4.9 and 5.5.2 fix this problem by utilizing encrypted channel to download the firmware.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.