A vulnerability has been discovered in Ubiquiti UniFi, which can lead to local privilege escalation.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-wireless/unifi | * | < 8.5.6 | >= 8.5.6 |
Ubiquiti UniFi is a Management Controller for Ubiquiti Networks UniFi APs.
A vulnerability has been discovered in Ubiquiti UniFi. Please review the CVE identifier referenced below for details.
The vulnerability allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server.
There is no known workaround at this time.
All Ubiquiti UniFi users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-wireless/unifi-8.5.6"
A vulnerability has been discovered in unifi where bundled log4j can facilitate a remote code execution
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| net-wireless/unifi | * | < 6.5.55 | >= 6.5.55 |
Ubiquiti UniFi is a Management Controller for Ubiquiti Networks UniFi APs.
A bundled version of log4j could facilitate remote code execution. Please review the CVE identifier referenced below for details.
An attacker with permission to modify the logging configuration file can construct a malicious configuration using a JDBC Appender with a data source referencing a JNDI URI which can execute remote code.
There is no known workaround at this time.
All Ubiquity UniFi users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-wireless/unifi-6.5.55"