CVE-2023-24104
📋 TL;DR
This vulnerability in Ubiquiti Networks UniFi Dream Machine Pro allows attackers to bypass domain restrictions via crafted packets, potentially enabling unauthorized network access or traffic redirection. It affects users running version 7.2.95 of the UniFi Dream Machine Pro network appliance.
💻 Affected Systems
- Ubiquiti Networks UniFi Dream Machine Pro
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass all domain-based security controls, redirect traffic to malicious destinations, intercept sensitive data, or gain persistent network foothold.
Likely Case
Attackers bypass domain filtering rules to access restricted resources or redirect users to malicious sites.
If Mitigated
With proper network segmentation and additional security layers, impact limited to specific network segments.
🎯 Exploit Status
Crafted packet attacks typically require network access but no authentication. MITRE ATT&CK T1090.004 indicates proxy/tunnel techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 7.2.95 (check Ubiquiti for specific fixed version)
Vendor Advisory: https://community.ui.com/releases
Restart Required: Yes
Instructions:
1. Log into UniFi Network Controller 2. Navigate to Devices > select Dream Machine Pro 3. Check for firmware updates 4. Apply latest firmware 5. Reboot device after update
🔧 Temporary Workarounds
Network Segmentation
allIsolate UniFi Dream Machine Pro from untrusted networks and implement additional firewall rules
Domain Restriction Enhancement
allImplement additional DNS filtering or proxy solutions as secondary domain control layer
🧯 If You Can't Patch
- Implement strict network access controls to limit who can send packets to the Dream Machine Pro
- Deploy intrusion detection systems to monitor for crafted packet attacks and domain bypass attempts
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in UniFi Network Controller under Devices > Dream Machine Pro > DetailsCheck Version:
ssh admin@[device-ip] 'show version' or check via UniFi Network Controller web interfaceVerify Fix Applied:
Verify firmware version is updated beyond 7.2.95 and test domain restrictions with controlled test traffic📡 Detection & Monitoring
Log Indicators:
- Unusual packet patterns to Dream Machine Pro
- Domain restriction rule violations
- Unexpected proxy/tunnel activity
Network Indicators:
- Crafted packets targeting port 53 or other Dream Machine Pro services
- Traffic bypassing expected domain filters
SIEM Query:
source_ip=[Dream-Machine-Pro-IP] AND (packet_size_anomaly OR protocol_anomaly)