UniFi Protect Application vulnerabilities

A malicious actor with access to the adjacent network could obtain unauthorized access to a UniFi Protect Camera by exploiting a discovery protocol vulnerability in the Unifi Protect Application (Version 6.1.79 and earlier).

An attacker with network access and low privileges could exploit an Improper Input Validation vulnerability in UniFi Protect Application to execute a Command Injection on the host device.

An attacker with network access can exploit an improper input validation vulnerability in the UniFi Protect Application to execute a command injection on the host device.

An Improper Input Validation vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to execute a Command Injection on the host device.

An SSRF vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to escalate privileges on the host device.

An authenticated SQL Injection vulnerability in UniFi Protect Application allows an attacker with network access and low privileges to escalate privileges on the host device.

A vulnerability in UniFi Protect Application allows an attacker with network access to bypass authentication for data streaming due to improper access control.

An Improper Access Control vulnerability in UniFi Protect Application allows a network-accessible attacker to bypass authentication in certain API endpoints.