CVE-2024-22054
High
Description
A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device management and discovery. Affected Products: UniFi Access Points UniFi Switches UniFi LTE Backup UniFi Express (Only Mesh Mode, Router mode is not affected) Mitigation: Update UniFi Access Points to Version 6.6.55 or later. Update UniFi Switches to Version 6.6.61 or later. Update UniFi LTE Backup to Version 6.6.57 or later. Update UniFi Express to Version 3.2.5 or later.
SeverityHigh
CVSS7.5
Exploit probability—
ProductUniFi Access Points
PublishedFeb 20, 2024
First seenFeb 20, 2024
Weakness typeCWE-20Improper input validation
How to fix
Update
- Ubiquiti Inc UniFi Access Points6.6.55 or later
- Ubiquiti Inc UniFi Switches6.6.61 or later
- Ubiquiti Inc UniFi LTE Backup6.6.57 or later
- Ubiquiti Inc UniFi Express3.2.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Ubiquiti Inc UniFi Access Points | 6.6.55 | 6.6.55 |
| Ubiquiti Inc UniFi Switches | 6.6.61 | 6.6.61 |
| Ubiquiti Inc UniFi LTE Backup | 6.6.57 | 6.6.57 |
| Ubiquiti Inc UniFi Express | 3.2.5 | 3.2.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.