Details of VAR-201704-1633

ID

VAR-201704-1633

TITLE

Ubiquiti Networking product multiple command injection vulnerability

Trust: 0.6

sources: CNVD: CNVD-2017-05071

DESCRIPTION

UbiquitiNetworksTS-8-PRO and others are products developed by Ubiquiti Networks. The TS-8-PRO is a switch. There are multiple command injection vulnerabilities in the UbiquitiNetworking product. The vulnerability is caused by the failure to validate the data submitted by the user. An attacker can exploit a vulnerability to inject arbitrary commands into the target application context and can also cause a denial of service. Ubiquiti Networking Products is prone to multiple command-injection vulnerabilities because it fails to properly sanitize user-supplied input. Failed exploit attempts will result in a denial-of-service condition

Trust: 0.81

sources: CNVD: CNVD-2017-05071 // BID: 96967

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2017-05071

AFFECTED PRODUCTS

vendor:	ubiquiti	model:	ts-8-pro	scope:	eq	version:	1.3.3	Trust: 0.6
vendor:	ubiquiti	model:	nanostation m5	scope:	eq	version:	5.6.9	Trust: 0.6
vendor:	ubiquiti	model:	nanostation m5	scope:	eq	version:	6.0	Trust: 0.6
vendor:	ubiquiti	model:	nsm5	scope:	eq	version:	5.6.9	Trust: 0.6
vendor:	ubiquiti	model:	nsm5	scope:	eq	version:	6.0	Trust: 0.6
vendor:	ubiquiti	model:	picostation m2hp	scope:	eq	version:	5.6.9	Trust: 0.6
vendor:	ubiquiti	model:	picostation m2hp	scope:	eq	version:	6.0	Trust: 0.6
vendor:	ubiquiti	model:	picom2hp	scope:	eq	version:	5.6.9	Trust: 0.6
vendor:	ubiquiti	model:	picom2hp	scope:	eq	version:	6.0	Trust: 0.6
vendor:	ubiquiti	model:	rocket m5	scope:	eq	version:	5.6.9	Trust: 0.6
vendor:	ubiquiti	model:	rocket m5	scope:	eq	version:	6.0	Trust: 0.6
vendor:	ubiquiti	model:	networks ts-8-pro	scope:	eq	version:	1.3.3	Trust: 0.3
vendor:	ubiquiti	model:	networks m5	scope:	eq	version:	5.6.9	Trust: 0.3
vendor:	ubiquiti	model:	networks m5	scope:	eq	version:	6.0	Trust: 0.3
vendor:	ubiquiti	model:	networks picom2hp	scope:	eq	version:	5.6.9	Trust: 0.3
vendor:	ubiquiti	model:	networks picom2hp	scope:	eq	version:	6.0	Trust: 0.3
vendor:	ubiquiti	model:	networks nsm5	scope:	eq	version:	5.6.9	Trust: 0.3
vendor:	ubiquiti	model:	networks nsm5	scope:	eq	version:	6.0	Trust: 0.3

sources: CNVD: CNVD-2017-05071 // BID: 96967

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2017-05071
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2017-05071
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:N/A:P
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	NONE
availabilityImpact:	PARTIAL
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2017-05071

THREAT TYPE

network

Trust: 0.3

sources: BID: 96967

TYPE

Unknown

Trust: 0.3

sources: BID: 96967

PATCH

title:

UbiquitiNetworking product patch for multiple command injection vulnerabilities

url:

https://www.cnvd.org.cn/patchinfo/show/92371

Trust: 0.6

sources: CNVD: CNVD-2017-05071

EXTERNAL IDS

db:	BID	id:	96967	Trust: 0.9
db:	CNVD	id:	CNVD-2017-05071	Trust: 0.6

sources: CNVD: CNVD-2017-05071 // BID: 96967

REFERENCES

url:	http://www.securityfocus.com/bid/96967	Trust: 0.6
url:	http://ubnt.com/	Trust: 0.3
url:	https://www.sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170316-0_ubiquiti_networks_authenticated_command_injection_v10.txt	Trust: 0.3

sources: CNVD: CNVD-2017-05071 // BID: 96967

CREDITS

SEC Consultants.

Trust: 0.3

sources: BID: 96967

SOURCES

db:	CNVD	id:	CNVD-2017-05071
db:	BID	id:	96967

LAST UPDATE DATE

2022-05-17T01:47:54.412000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-05071	date:	2017-04-22T00:00:00
db:	BID	id:	96967	date:	2017-03-23T02:01:00

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2017-05071	date:	2017-04-24T00:00:00
db:	BID	id:	96967	date:	2017-03-16T00:00:00