VulnerabilityModified
CVE-2020-24755
In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory.
HIGH 7.8EPSS 0.58%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.58%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. This allows the impersonation and modification of the library to execute code on the system. This was tested in (Windows 7 x64/Windows 10 x64).
- CVSS 3.1
- 7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 0.58% probability · 46th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-427
- Affected
- ui/unifi video
- Source
- cve@mitre.org
References
- https://www.youtube.com/watch?v=T41h4yeh9dkExploit, Third Party Advisory
- https://www.youtube.com/watch?v=T41h4yeh9dkExploit, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.