CVE-2024-34786

UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network Application) that could cause the SSID name to change and/or the WiFi Password to be removed on the 5GHz Radio. This vulnerability is fixed in UniFi iOS app 10.15.2 and later.

CVSS v3 4.8 MEDIUM

4.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://community.ui.com/releases/Security-Advisory-Bulletin-040-040/b4b508c0-8453-405b-8660-1f55ade669c0
https://community.ui.com/releases/Security-Advisory-Bulletin-040-040/b4b508c0-8453-405b-8660-1f55ade669c0

Configurations

No configuration.

History

No history.

Information

Published : 2024-07-09 02:15

Updated : 2026-06-17 07:34

NVD link : CVE-2024-34786

Mitre link : CVE-2024-34786

CVE.ORG link : CVE-2024-34786

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2024-34786", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-34786", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-09T17:46:06.532540Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}]}, "affected": [{"source": "support@hackerone.com", "affectedData": [{"vendor": "Ubiquiti", "product": "UniFi iOS App", "versions": [{"status": "affected", "version": "10.15.2", "lessThan": "10.15.2", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2024-07-09T02:15:10.177", "references": [{"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-040-040/b4b508c0-8453-405b-8660-1f55ade669c0", "source": "support@hackerone.com"}, {"url": "https://community.ui.com/releases/Security-Advisory-Bulletin-040-040/b4b508c0-8453-405b-8660-1f55ade669c0", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "descriptions": [{"lang": "en", "value": "UniFi iOS app 10.15.0 introduces a misconfiguration on 2nd Generation UniFi Access Points configured as standalone (not using UniFi Network Application) that could cause the SSID name to change and/or the WiFi Password to be removed on the 5GHz Radio.\n\nThis vulnerability is fixed in UniFi iOS app 10.15.2 and later."}, {"lang": "es", "value": "La aplicaci\u00f3n UniFi iOS 10.15.0 introduce una configuraci\u00f3n incorrecta en los puntos de acceso UniFi de segunda generaci\u00f3n configurados como independientes (sin usar la aplicaci\u00f3n de red UniFi) que podr\u00eda provocar que el nombre SSID cambie y/o que se elimine la contrase\u00f1a WiFi en la radio de 5 GHz. Esta vulnerabilidad se solucion\u00f3 en la aplicaci\u00f3n UniFi iOS 10.15.2 y posteriores."}], "lastModified": "2026-06-17T07:34:03.713", "sourceIdentifier": "support@hackerone.com"}