UI vulnerabilities1 known to be exploited.
UI has 81 published vulnerabilities across 257 products in our catalogue. 1 of them is on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Er-X, with 9. If you run UI software, patch the exploited flaws first.
The most recent UI flaw added to the known-exploited list is CVE-2010-5330, on 15 April 2022. We keep watching the known-exploited list.
Which UI products have the most vulnerabilities?
Er-X leads with 9 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which UI vulnerabilities are being exploited?
1 flaw is on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 9.8Ubiquiti AirOS Command Injection Vulnerability
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
Which UI flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 74%CVE-2015-9266Critical
The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques.
- 39%
On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters.
- 23%CVE-2013-1606High
Buffer overflow in the ubnt-streamer RTSP service on the Ubiquiti UBNT AirCam with airVision firmware before 1.1.6 allows remote attackers to execute arbitrary code via a long rtsp: URI in a DESCRIBE request.
- 21%CVE-2017-0938High
Denial of Service attack in airMAX < 8.3.2 , airMAX < 6.0.7 and EdgeMAX < 1.9.7 allow attackers to use the Discovery Protocol in amplification attacks.
- 15%CVE-2020-12695High
The Open Connectivity Foundation UPnP specification before 2020-04-17 does not forbid the acceptance of a subscription request with a delivery URL on a different network segment than the fully qualified...
- 9.3%CVE-2023-2375High
A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6 and classified as critical.
- 7.6%CVE-2023-2377High
A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6.
- 7.6%CVE-2023-2373High
A vulnerability, which was classified as critical, was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6.
- 7.6%CVE-2023-2376High
A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6.
- 7.6%CVE-2023-2378High
A vulnerability was found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6.
All UI products we track.
66 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Er-X Firmwareer-x_firmware8 vulnerabilities5 versions
- Er-X-Sfp Firmwareer-x-sfp_firmware8 vulnerabilities5 versions
- Unifi Videounifi_video7 vulnerabilities31 versions
- Unifi Controllerunifi_controller6 vulnerabilities9 versions
- Airosairos5 vulnerabilities41 versions
- Edgeswitch Firmwareedgeswitch_firmware5 vulnerabilities4 versions
- Unifi Protectunifi_protect5 vulnerabilities3 versions
- Desktopdesktop4 vulnerabilities4 versions
- Edgemax Edgerouter Firmwareedgemax_edgerouter_firmware4 vulnerabilities1 version
- Unifi Network Applicationunifi_network_application4 vulnerabilities49 versions
- Edgerouter X Firmwareedgerouter_x_firmware3 vulnerabilities1 version
- Edgeswitch Xedgeswitch_x3 vulnerabilities9 versions
- Unifi Switch Firmwareunifi_switch_firmware3 vulnerabilities12 versions
- Airmax Ac Firmwareairmax_ac_firmware2 vulnerabilities1 version
- Camera G3 Flex Firmwarecamera_g3_flex_firmware2 vulnerabilities1 version
- Cloud Key Gen2cloud_key_gen22 vulnerabilities1 version
- Cloud Key Gen2 Pluscloud_key_gen2_plus2 vulnerabilities1 version
- Edgemax Firmwareedgemax_firmware2 vulnerabilities17 versions
- Edgeosedgeos2 vulnerabilities2 versions
- Edgeswitchedgeswitch2 vulnerabilities2 versions
- Er-12 Firmwareer-12_firmware2 vulnerabilities5 versions
- Er-4 Firmwareer-4_firmware2 vulnerabilities5 versions
- Er-6p Firmwareer-6p_firmware2 vulnerabilities5 versions
- Er-8-Xg Firmwareer-8-xg_firmware2 vulnerabilities5 versions
This directory lists the 66 UI products with at least one tracked version, of 257 in our catalogue.
Running UI? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Certain Ubiquiti devices contain a command injection vulnerability via a GET request to stainfo.cgi.
- Matched to
- Ar on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 81 published vulnerabilities across 257 products and 501 versions from UI. The most recent UI flaw added to the known-exploited list is CVE-2010-5330, on 15 April 2022.
1 UI vulnerability is on the list of flaws known to be exploited. The most recently added is CVE-2010-5330. The full list is on this page.
Er-X, with 9 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the UI products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.