CVE-2024-29207

HIGH

UniFi Connect <3.7.9 - Info Disclosure

Title source: llm
STIX 2.1

Description

An Improper Certificate Validation could allow a malicious actor with access to an adjacent network to take control of the system. Affected Products: UniFi Connect Application (Version 3.7.9 and earlier) UniFi Connect EV Station (Version 1.1.18 and earlier) UniFi Connect EV Station Pro (Version 1.1.18 and earlier) UniFi Connect Display (Version 1.9.324 and earlier) UniFi Connect Display Cast (Version 1.6.225 and earlier) Mitigation: Update UniFi Connect Application to Version 3.10.7 or later. Update UniFi Connect EV Station to Version 1.2.15 or later. Update UniFi Connect EV Station Pro to Version 1.2.15 or later. Update UniFi Connect Display to Version 1.11.348 or later. Update UniFi Connect Display Cast to Version 1.8.255 or later.

Scores

CVSS v3 7.5
EPSS 0.0032
EPSS Percentile 24.3%
Attack Vector ADJACENT_NETWORK
CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-284
Status published
Products (5)
Ubiquiti Inc/UniFi Connect Application 3.10.7
Ubiquiti Inc/UniFi Connect Display 1.11.348
Ubiquiti Inc/UniFi Connect Display Cast 1.8.255
Ubiquiti Inc/UniFi Connect EV Station 1.2.15
Ubiquiti Inc/UniFi Connect EV Station Pro 1.2.15
Published May 07, 2024
Tracked Since Feb 18, 2026