UI UniFi Controller vulnerabilities

5 CVEs affecting UI UniFi Controller, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2020-12695, published 2020-06-08.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2020-12695, published 2020-06-08. High severity, CVSS 7.5. EPSS: 15.2% chance of exploitation in the next 30 days. The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully…
CVE-2013-3572, published 2013-12-31. Medium severity, CVSS 6.1. EPSS: 1.6% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject arbitrary web script or…
CVE-2014-2226, published 2014-07-29. Low severity, CVSS 2.6. EPSS: 1.5% chance of exploitation in the next 30 days. Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors.
CVE-2019-5456, published 2019-07-30. High severity, CVSS 8.1. EPSS: 1.3% chance of exploitation in the next 30 days. SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use…
CVE-2014-2225, published 2020-02-08. High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days. Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of administrators for requests that…