CVE-2024-42025

HIGH

UniFi Network Application < 8.4.59 - Authenticated Command Injection via Self-Hosted Server

Title source: llm
STIX 2.1

Description

A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.3.32 and earlier) allows a malicious actor with unifi user shell access to escalate privileges to root on the host device.

References (1)

Core 1

Scores

CVSS v3 7.8
EPSS 0.0079
EPSS Percentile 51.4%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-77
Status published
Products (1)
ui/unifi_network_application < 8.4.59
Published Sep 13, 2024
Tracked Since Feb 18, 2026