GCVE - cpe:2.3:a:ui:unifi_controller:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:ui:unifi_controller:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Ui (`05cd6c40-c92e-5edc-9588-6ff25fd55039`)
Product	Unifi Controller (`9fb5c28d-a125-5fdd-a6cf-8bcd1c48469c`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2019-5456`	vulnerable	2026-06-08 05:13:59.210766	Details available SMTP MITM refers to a malicious actor setting up an SMTP proxy server between the UniFi Controller version <= 5.10.21 and their actual SMTP server to record their SMTP credentials for malicious use later. Published: 2019-07-30T20:19:48.000Z Updated: 2024-08-04T19:54:53.544Z Open on db.gcve.eu Reference links https://hackerone.com/reports/519582 https://community.ui.com/releases/Security-Advisory-Bulletin-003-003/982bbaa8-2a07-4f81-a5f6-0bb84753f391 https://community.ui.com/releases/862b962b-55f6-4324-96be-610f647d5c1c https://community.ui.com/releases/9f698d0b-8279-40d3-9f1a-d36db4813124	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2226`	vulnerable	2026-06-08 05:05:27.966330	Details available Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtain sensitive information via unspecified vectors. Published: 2014-07-29T14:00:00.000Z Updated: 2024-08-06T10:06:00.189Z Open on db.gcve.eu Reference links http://www.securityfocus.com/bid/68869 http://packetstormsecurity.com/files/127616/Ubiquiti-UbiFi-Controller-2.4.5-Password-Hash-Disclosure.html http://seclists.org/fulldisclosure/2014/Jul/127 http://sethsec.blogspot.com/2014/07/cve-2014-2226.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-2225`	vulnerable	2026-06-08 05:05:27.965930	Details available Multiple cross-site request forgery (CSRF) vulnerabilities in Ubiquiti Networks UniFi Controller before 3.2.1 allow remote attackers to hijack the authentication of administrators for requests that (1) create a new admin user via a request to api/add/admin; (2) have unspecified impact via a request to api/add/wlanconf; change the guest (3) password, (4) authentication method, or (5) restricted subnets via a request to api/set/setting/guest_access; (6) block, (7) unblock, or (8) reconnect users by MAC address via a request to api/cmd/stamgr; change the syslog (9) server or (10) port via a request to api/set/setting/rsyslogd; (11) have unspecified impact via a request to api/set/setting/smtp; change the syslog (12) server, (13) port, or (14) authentication settings via a request to api/cmd/cfgmgr; or (15) change the Unifi Controller name via a request to api/set/setting/identity. Published: 2020-02-08T15:56:28.000Z Updated: 2024-08-06T10:05:59.987Z Open on db.gcve.eu Reference links http://sethsec.blogspot.com/2014/07/cve-2014-2225.html http://seclists.org/fulldisclosure/2014/Jul/126	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2013-3572`	vulnerable	2026-06-08 05:04:32.082339	Details available Cross-site scripting (XSS) vulnerability in the administer interface in the UniFi Controller in Ubiquiti Networks UniFi 2.3.5 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted client hostname. Published: 2013-12-31T20:00:00.000Z Updated: 2024-08-06T16:14:56.451Z Open on db.gcve.eu Reference links https://community.ubnt.com/t5/UniFi/Security-Advisory-CVE-2013-3572/m-p/601047#U601047 http://dl.ubnt.com/unifi/static/cve-2013-3572.html http://www.securityfocus.com/bid/64601 http://spaceblogs.org/shackspace/2013/10/shackspace-hacker-finds-flaw-in-ubiquiti-networks-unifi-products/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.