Ui Unifi Network Application vulnerabilities

CVE-2023-28365 [CRITICAL] CWE-77 CVE-2023-28365: A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linu A backup file vulnerability found in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored.

CVE-2024-42025 [HIGH] CWE-77 CVE-2024-42025: A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Ne A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device.

CVE-2023-41721 [MEDIUM] CWE-284 CVE-2023-41721: Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are ver Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. and earlier, implement device adoption with improper access control logic, creating a risk of access to device configuration information by a malicious actor with preexisting access to the network. Affected Products: UDM UDM-PRO UDM-SE

CVE-2023-32000 [MEDIUM] CWE-79 CVE-2023-32000: A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allow A Cross-Site Scripting (XSS) vulnerability found in UniFi Network (Version 7.3.83 and earlier) allows a malicious actor with Site Administrator credentials to escalate privileges by persuading an Administrator to visit a malicious web page.