Ubiquiti Security AP and Switch Vulnerabilities

TWiT Shows Security Now
1

Subheading: Ubiquiti AP and Switch SNMP Monitoring: CVE-2023-35085 and DHCP Client Vulnerability: CVE-2023-38034

Hey @Leo,

I was hoping that you’ll get his. I heard this evening on your show that you have Ubiquiti APs and Switches installed in your home and maybe your studio. Tonight I saw this Security Notice (https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-9884-44df-b1c6-63c6499f6e56) posted on the Ubiquiti Community Website and thought you might be interested.

Chasing down the CVE CVSS 3.0 scores at a 9.0 for CVE-2023-35085 and 8.4 for CVE-2023-38034 (out of 10.0). As you know, these aren’t excellent scores.

The first vulnerability is with the SNMP agent on each AP and switch. With a typical household or business network, SNMP would typically be blocked from the Internet. So not much of a worry unless you offer open WiFi or guest ethernet access. So either disable SNMP on all APs and Switches using the Ubiquiti Network Application or apply the newest firmware updates.

For the second vulnerability, the flaw is with the DHCP client. Again, the attacker must be on your local network to exploit the vulnerability. The problem is with the AP or switch picking up an IP address. It should be no issue if you are using fixed IP addresses for your APs and switches. If not, you probably want to patch it as soon as you can get to it.

Or you can go all The Treasure of Sierra Madre:

“Patches! Patches? We don’t need no stinkin’ patches.”

My deepest apologies to any Bogart and Huston fans. Again hope this reaches you, and good luck. If you have any questions or ask Steve, I’m sure he can make a meal of this.

By the way, I run the same kit and hear the same “Dear; there’s something going on with the network…” occasionally.

Kind Regards Bill

Also sent to info@twit.tv

1 Like
2

Twit.com is a completely different site unrelated to twit.tv

3

You can probably update the firmware in the UI, but if you want a quick check if there is something recent to get, this list might be useful: https://ui.com/download/releases/firmware

4

This seems to affect older firmware version (6.5.53 and earlier for APs and 6.5.32 for switches). Anybody who has already updated to newer versions is not affected.

Just checked, my APs are already on 6.5.62 and the switch is on 6.5.59. I updated them with the recommended updates 14 days ago, so it looks like they pushed the updates, then a week later released the advisory.

5

Yep, I messed that up working from memory - I checked and did send it to info@twit.tv. Thanks for pointing that out. Updated the original post.

6

I run only the APs and had already pushed updated firmware two weeks or so earlier. Posted the Security Advisory here as some people don’t patch as often.

1 Like
7

I only have the APs and they auto update themselves so I’m up to date :+1: