Ubiquiti patches six vulnerabilities in UniFi Protect AI Key surveillance appliance

Ubiquiti patches six AI Key vulnerabilities

Ubiquiti, an American technology company that manufactures networking products, has disclosed six vulnerabilities affecting its video surveillance appliance AI Key. Attackers on the same network can inject commands, disrupt or compromise the device, and access sensitive information.

UniFi Protect AI Key is a physical device that adds AI-driven threat detection and alerting to UniFi Protect, the company's enterprise-grade video surveillance and physical security system. The appliance searches footage, recognizes faces or license plates, and can analyze up to 1,800 smart detection events per hour.

Most severe flaw requires no login

The most serious bug is an improper access control vulnerability, rated 8.6 out of 10 on the severity score. Malicious attackers with access to the network can leverage it to obtain information, make unauthorized changes, and execute a Denial of Service (DoS) attack on the device. No privileges or user interaction are required, and the attack complexity is low.

Another high-severity (8.1 out of 10) input validation vulnerability allows threat actors, under certain conditions, to inject commands into the vulnerable device, Ubiquiti's new advisory reads.

Less severe issues and update urged

Four other vulnerabilities are less severe. Two medium-severity bugs expose internal resources through the device. Two low-severity path traversal flaws allow attackers to create or truncate files on the device, or obtain information about existing files. The vulnerabilities can be chained together to potentially pull off a more damaging attack.

Ubiquiti credited the discoveries to security researcher Andy Gill of ZephrSec Ltd. The advisory doesn't mention whether these bugs have been exploited in real-world attacks. All the vulnerabilities affect AI Key devices running version 2.2.6 or earlier. Ubiquiti urges users to update their devices to the latest version, currently 2.2.8, released 24 days ago.

Sources: Cybernews