CVE-2023-35085
📋 TL;DR
An integer overflow vulnerability in UniFi network devices with SNMP monitoring enabled allows remote attackers to execute arbitrary code. This affects all UniFi Access Points (v6.5.50 and earlier) and Switches (v6.5.32 and earlier), excluding Switch Flex Mini. Devices with default settings are vulnerable.
💻 Affected Systems
- UniFi Access Points
- UniFi Switches
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote unauthenticated attacker gains full control of affected device, potentially pivoting to internal network or disrupting operations.
Likely Case
Remote code execution leading to device compromise, data exfiltration, or network disruption.
If Mitigated
No impact if devices are patched or SNMP monitoring is disabled on vulnerable versions.
🎯 Exploit Status
CVSS 9.8 indicates critical severity with low attack complexity. No public exploit code known at advisory time.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Access Points: v6.5.62 or later; Switches: v6.5.59 or later
Vendor Advisory: https://community.ui.com/releases/Security-Advisory-Bulletin-035-035/91107858-9884-44df-b1c6-63c6499f6e56
Restart Required: Yes
Instructions:
1. Log into UniFi Network Controller. 2. Navigate to Devices section. 3. Select affected devices. 4. Click 'Upgrade' to apply latest firmware. 5. Reboot devices after update.
🔧 Temporary Workarounds
Disable SNMP Monitoring
allTemporarily disable SNMP monitoring on vulnerable devices until patching is complete.
In UniFi Controller: Settings > System > SNMP > Disable SNMP
🧯 If You Can't Patch
- Disable SNMP monitoring on all vulnerable devices immediately.
- Isolate affected devices to separate VLAN with strict network access controls.
🔍 How to Verify
Check if Vulnerable:
Check device firmware version in UniFi Controller under Devices > select device > Properties.Check Version:
In UniFi Controller CLI: info | grep VersionVerify Fix Applied:
Confirm firmware version is v6.5.62+ for Access Points or v6.5.59+ for Switches.📡 Detection & Monitoring
Log Indicators:
- Unusual SNMP traffic patterns
- Unexpected device reboots
- Unauthorized configuration changes
Network Indicators:
- Abnormal SNMP requests to UniFi devices on UDP port 161
- Unexpected outbound connections from UniFi devices
SIEM Query:
source="unifi-device" AND (event_type="firmware_update" OR event_type="config_change")