CVE-2022-22570
📋 TL;DR
A buffer overflow vulnerability in UniFi Door Access Reader Lite firmware allows attackers with network access to execute arbitrary code and take control of all connected UA devices. This affects organizations using UA Lite devices with firmware version 3.8.28.24 or earlier. The vulnerability enables complete device compromise.
💻 Affected Systems
- UniFi Door Access Reader Lite (UA Lite)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full network compromise of all connected UA devices, enabling physical access control bypass, data exfiltration, and lateral movement to other network systems.
Likely Case
Attackers gaining administrative control over door access systems, potentially locking/unlocking doors, disabling security features, and using devices as footholds for further attacks.
If Mitigated
Limited impact if devices are isolated in separate VLANs with strict network segmentation and access controls preventing lateral movement.
🎯 Exploit Status
Exploitation requires network access but no authentication. Buffer overflow vulnerabilities are typically straightforward to exploit once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.8.31.13 and later
Vendor Advisory: https://community.ui.com/releases/Security-Advisory-Bulletin-024-024/22725557-0f72-4f5d-83b0-f16252fcd4b7
Restart Required: Yes
Instructions:
1. Log into UniFi Network Controller. 2. Navigate to Devices section. 3. Select affected UA Lite devices. 4. Click Update Firmware. 5. Ensure version is 3.8.31.13 or higher. 6. Reboot devices after update.
🔧 Temporary Workarounds
Network Segmentation
allIsolate UA Lite devices in separate VLAN with strict firewall rules preventing access from untrusted networks.
Access Control Lists
allImplement network ACLs to restrict which systems can communicate with UA Lite devices.
🧯 If You Can't Patch
- Physically disconnect vulnerable devices from network until patching possible
- Implement strict network monitoring and alerting for any communication attempts to UA Lite devices
🔍 How to Verify
Check if Vulnerable:
Check firmware version in UniFi Network Controller under Devices > select UA Lite > check Firmware version.Check Version:
No CLI command - check via UniFi Network Controller web interfaceVerify Fix Applied:
Confirm firmware version shows 3.8.31.13 or higher in UniFi Network Controller.📡 Detection & Monitoring
Log Indicators:
- Unusual authentication attempts
- Firmware modification logs
- Unexpected device reboots
Network Indicators:
- Unusual traffic patterns to UA Lite devices
- Port scanning from internal systems targeting UA Lite
SIEM Query:
source="unifi" AND (event_type="firmware_update" OR event_type="device_reboot") AND device_type="UA Lite"