UniFi OS Improper Certificate Validation Vulnerability Allowing Man-in-the-Middle Attacks

A vulnerability exists in UniFi OS devices with Identity Enterprise configured, allowing improper certificate validation. This flaw could enable a malicious actor to perform a man-in-the-middle (MitM) attack during application updates.

Impact

Exploitation of this vulnerability could lead to a man-in-the-middle attack, allowing interception and potentially modification of data during application updates.

Remediation

Users are advised to update their devices to the following versions: UDM, UDM-Pro, UDM-SE, UDM-Pro-Max, UDW, UCKP, UCK, UCK-Enterprise, UCG-Max, and EFG to Version 4.1.13 or later. UNVR and UNVR PRO should be updated to Version 4.1.11 or later.