CVE-2021-22882 - UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-servic

CVE-2021-22882

Summary

UniFi Protect before v1.17.1 allows an attacker to use spoofed cameras to perform a denial-of-service attack that may cause the UniFi Protect controller to crash.

References

https://community.ui.com/releases/Security-advisory-bulletin-017-017/071141e5-bc2e-4b71-81f3-5e499316fcee
https://hackerone.com/reports/1008579

Vulnerable Configurations

cpe:2.3:a:ui:unifi_protect_controller:*:*:*:*:*:*:*:*
cpe:2.3:a:ui:unifi_protect_controller:*:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_cloud_key_plus:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_dream_machine_pro:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:*
cpe:2.3:h:ui:unifi_network_video_recorder:-:*:*:*:*:*:*:*

CVSS

Base:	5.0 (as of 30-08-2022 - 22:38)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
NONE	NONE	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:N/I:N/A:P

Last major update

30-08-2022 - 22:38

Published

23-02-2021 - 19:15

Last modified

30-08-2022 - 22:38