CVE-2023-35085
Published: 10 August 2023
Summary
CVE-2023-35085 is a critical-severity Integer Overflow or Wraparound (CWE-190) vulnerability in Ui Unifi Uap Firmware. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 11.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
An integer overflow vulnerability, tracked as CVE-2023-35085 and assigned CWE-190, affects UniFi Access Points running version 6.5.50 and earlier as well as UniFi Switches running version 6.5.32 and earlier, excluding the Switch Flex Mini. The flaw is present when SNMP monitoring is enabled under default settings and can result in remote code execution.
Unauthenticated remote attackers can exploit the issue over the network without user interaction to achieve full compromise of affected devices, as reflected in the CVSS 9.8 score indicating high impact to confidentiality, integrity, and availability.
Ubiquiti's security advisory directs administrators to update Access Points to version 6.5.62 or later and Switches to version 6.5.59 or later. The associated EPSS score reached a peak of 0.0704 after disclosure before receding to its current value of 0.0401.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-39120
Vulnerability details
An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default settings enabled could allow a Remote Code Execution (RCE). Affected Products: All UniFi Access Points (Version 6.5.50 and earlier)…
more
All UniFi Switches (Version 6.5.32 and earlier) -USW Flex Mini excluded. Mitigation: Update UniFi Access Points to Version 6.5.62 or later. Update the UniFi Switches to Version 6.5.59 or later.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.