Ubiquiti Inc. · Report #512958
Login as root without password on EdgeSwitchX
Validstatus
mediumseverity
56upvotes
31 Mar 2019disclosed
Summary
In EdgeSwitch X v1.1.0 and prior, an unauthenticated user can use the "local port forwarding" and "dynamic port forwarding" (SOCKS proxy) functionalities. Remote attackers without credentials can exploit this bug to access local services or forward traffic through the device if SSH is enabled in the system settings.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.