CVE-2021-22943
📋 TL;DR
This vulnerability allows an attacker who has already compromised a network to take control of UniFi Protect cameras on that network. It affects UniFi Protect application versions 1.18.1 and earlier. The issue stems from improper authentication (CWE-287) that permits unauthorized camera control.
💻 Affected Systems
- UniFi Protect application
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of all cameras on the network, enabling surveillance, data exfiltration, or using cameras as footholds for further network attacks.
Likely Case
Unauthorized access to camera feeds, manipulation of camera settings, or disabling surveillance capabilities.
If Mitigated
Limited impact if network segmentation prevents lateral movement from initial compromise to camera network segment.
🎯 Exploit Status
Exploitation requires existing network access; authentication bypass enables camera control.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: V1.19.0 and later
Vendor Advisory: https://community.ui.com/releases/Security-Advisory-Bulletin-019-019/90a00abe-d6b6-43c6-92d4-0a0342f1506f
Restart Required: Yes
Instructions:
1. Backup UniFi Protect configuration. 2. Update UniFi Protect application to version 1.19.0 or later via UniFi OS Console or web interface. 3. Restart the application/service. 4. Verify cameras reconnect properly.
🔧 Temporary Workarounds
Network segmentation
allIsolate camera network from general user/management networks to limit lateral movement.
Access control lists
allImplement strict firewall rules limiting access to UniFi Protect management interface.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate cameras from other network segments
- Monitor network traffic to/from UniFi Protect application for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Check UniFi Protect application version in web interface or console; versions 1.18.1 or earlier are vulnerable.Check Version:
Check via UniFi Protect web interface or console interface version displayVerify Fix Applied:
Confirm UniFi Protect application version is 1.19.0 or later and test camera control functionality.📡 Detection & Monitoring
Log Indicators:
- Unauthorized access attempts to camera control endpoints
- Unusual camera configuration changes
Network Indicators:
- Unexpected traffic to camera control ports from unauthorized sources
- Anomalous camera management protocol traffic
SIEM Query:
source_ip NOT IN authorized_management_ips AND dest_port IN camera_control_ports