5 Critical UniFi CVEs and How to Avoid the Risk [YouTube Release]

Youtube Releases
1

Additional Resources:

Connect With Us

Lawrence Systems Shirts and Swag

►:t_shirt: Lawrence Systems

AFFILIATES & REFERRAL LINKS

Amazon Affiliate Store
:shopping_cart: Lawrence Systems's Amazon Page

UniFi Affiliate Link
:shopping_cart: Ubiquiti Store

All Of Our Affiliates help us out and can get you discounts!
:shopping_cart: Partners We Love – Lawrence Systems

Gear we use on Kit
:shopping_cart: https://kit.co/lawrencesystems

Use OfferCode LTSERVICES to get 10% off your order at
:shopping_cart: Tech Supply Direct - Premium Refurbished Servers & Workstations at Unbeatable Prices

Digital Ocean Offer Code
:shopping_cart: AI-Native Cloud | DigitalOcean

HostiFi UniFi Cloud Hosting Service
:shopping_cart: HostiFi - Fast and Reliable UniFi in the Cloud

Protect your privacy with a VPN from Private Internet Access
:shopping_cart: https://www.privateinternetaccess.com/pages/buy-vpn/LRNSYS

Patreon
:money_bag: https://www.patreon.com/lawrencesystems

Chapters
00:00 UniFi Security Advisory Bulletin 064
00:42 The Prerequisite
01:51 Ubiquiti’s Bug Bounty Program
02:43 How AI Changed the Bug Bounty Game
04:20 Patch Diffing and the “John Sim” Attacks
06:30 Why Auto-Updates Are Worth the Risk

2

I just watched your video and looked at the reddit threads of the accidental opening of the Unifi UI/control plane to the internet.

Would you be able to show a quick refresher for “do this to check that your Unifi is not exposed to the internet” at the end of a video like this one?

1 Like
3

You can use any site that will do public port scanning to check if port 8443 is open on your WAN. This is off by default so you could also check to see if you have any non-default firewall rules that allow access.

I also hav a video here on locking the system down even more
https://youtu.be/EGls6JvdaNc?si=Y5op_psbSRHzY3ij

2 Likes
4

Tom - you shared a point that getting hacked is far worse than perhaps having some downtime from auto-update gone wrong. I previously did not use auto-update, but after hearing your viewpoint here, it makes a lot of sense. Especially because I’m a home user / self-hoster and downtime is pretty low risk for me compared to a business user.

One question on this though- what about for homelabbers where my hypervisor is relying on my UCG-Fiber for network link to my NAS?

I.e. if my UCG-Fiber auto-patches, then my VMs lose their link to the vdisks while the UCG restarts. Of course in an ideal world, I’d have a separate 10GbE switch and could patch the firewall without restarting the switch. However the UCG-Fiber is an excellent deal for all that it offers and I don’t really see the value in getting a separate 10Gb switch just to let me auto-patch my firewall.

5

Aye aye! Thanks for the helpful answer :slight_smile:

6

It will disrupt and likely cause any VM’s to crash.

1 Like
7

I manage four sites, each with an original Unifi Dream Machine. They are all set to auto update every week. Unfortunately two of my four UDM got stuck in the update loop. The network and internet is still working fine, so no immediate action required. Still, at some point I need to get these UDM out of their loop. Any suggestions for best practices? Thanks!

consoleupdating
consoleupdating572×477 15 KB

8

If they are still routing but not bringing up the Network app a simple power cycle should fix them. If you have SSH access you could use that to log in and figure out why the app is not starting.

1 Like
9

Update on this topic: with no SSH access, my only solution was to unplug the Dream Machine. Once I plugged it back in, it kept blinking white. So I had to do a full reset and restore from backup.

10

Update on the second Dream Machine. After unplugging it came up normally in the Unifi controller, however, still at UniFi OS 5.1.12.. Unfortunately, I forgot to enable SSH. Last night, it followed its update schedule to update to UniFi OS 5.1.19. Now it’s unavailable again in the controller while still routing. What a pain :frowning: