Ubiquiti Inc. · Report #242407
Privilege Escalation with Session Hijacking Having a Non-privileged Valid User
Validstatus
criticalseverity
6upvotes
4 Dec 2017disclosed
Summary
EdgeOS version 1.9.1.1 and prior, consequence of lack of protection if the file-system, exposing sensitive information, an attacker with access to an operator (read-only) account, can escalate privileges to admin (root) access in the system.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.