CVE-2023-31997

UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB

published June 30, 2023

CVSS
—
EPSS
0%
Percentile
16.0
In the wild
Unconfirmed
What it is

⚠️ A little misconfiguration can lead to big problems! Local users can access MongoDB on UniFi OS 3.1 consoles, compromising your sensitive data! 🔥 Think of your network console as a cozy café. If the barista accidentally leaves the door wide open, anyone can stroll in and read the private orders sitting on the counter! This vulnerability could allow anyone on your local network to access and manipulate MongoDB data, leading to unauthorized access to sensitive configurations and user data. It’s like leaving your café's secret ingredient list out for everyone to see!

Put simply

Think of your network console as a cozy café. If the barista accidentally leaves the door wide open, anyone can stroll in and read the private orders sitting on the counter! The misconfiguration in UniFi OS 3.1 permits local network users to access MongoDB instances without proper security controls, exposing potentially sensitive data to unauthorized users.

What to do

This vulnerability could allow anyone on your local network to access and manipulate MongoDB data, leading to unauthorized access to sensitive configurations and user data. It’s like leaving your café's secret ingredient list out for everyone to see! To remedy this, ensure you update to the latest version of UniFi OS to eliminate this configuration issue. Additionally, review your network access policies to limit local user privileges. Regularly audit your network configuration for potential vulnerabilities! You've got this! Follow these steps to tighten up your security and keep those data thieves at bay! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00254 · 16.0th percentile
Published
2023-06-30T23:39Z
EPSS history
Timeline
  • 30 JUN 23:39Z
    UniFi OS 3.1 introduces a misconfiguration on consoles running UniFi Network that allows users on a local network to access MongoDB
    cvelistv5