CVE-2024-29208

An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password

Low · published May 7, 2024

CVSS v3.0
2.2
EPSS
0%
Percentile
26.3
In the wild
Unconfirmed
What it is

An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password.

Affected Products:

UniFi Connect EV Station (Version 1.1.18 and earlier)

UniFi Connect EV Station Pro (Version 1.1.18 and earlier)

UniFi Connect Display (Version 1.9.324 and earlier)

UniFi Connect Display Cast (Version 1.6.225 and earlier)

Mitigation:

Update UniFi Connect Application to Version 3.10.7 or later.

Update UniFi Connect EV Station to Version 1.2.15 or later.

Update UniFi Connect EV Station Pro to Version 1.2.15 or later.

Update UniFi Connect Display to Version 1.11.348 or later.

Update UniFi Connect Display Cast to Version 1.8.255 or later.

The record
Technical detail
CVSS v3.0
2.2 · LOW
Vector
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00341 · 26.3th percentile
Published
2024-05-07T16:40Z
EPSS history
Timeline
  • 07 MAY 16:40Z
    An Unverified Password Change could allow a malicious actor with API access to the device to change the system password without knowing the previous password
    cvelistv5