CVE Feed

    Dashboard / CVE / CVE-2023-28361

    CVE-2023-28361

    A Cross-site WebSocket Hijacking (CSWSH) vulnerability found in UniFi OS 2.5 and earlier allows a malicious actor to access certain confidential information by persuading a UniFi OS user to visit a malicious webpage.Affected Products:Cloud Key Gen2Cloud Key Gen2 PlusUNVRUNVR ProfessionalUDMUDM ProfessionalUDM SEUDRMitigation:Update affected products to UniFi OS 3.0.13 or later.

    Published:May 11, 2023
    Last Modified:Jan 27, 2025
    EPS:May 11, 2023
    EPSS Score:0.0016
    CVSS Score:6.5

    Affected Products

    Vendor
    Uni
    Product
    Cloud Key Gen2
    Vendor
    Uni
    Product
    Cloud Key Gen2 Plus
    Vendor
    Uni
    Product
    Ubiquiti Networks Unifi Dream Machine
    Vendor
    Uni
    Product
    Ubiquiti Networks Unifi Dream Machine Professional
    Vendor
    Uni
    Product
    Ubiquiti Networks Unifi Dream Machine Se
    Vendor
    Uni
    Product
    Unifi Dream Router
    Vendor
    Uni
    Product
    Unifi Os
    Vendor
    Uni
    Product
    Unifi Protect Network Video Recorder
    Vendor
    Uni
    Product
    Unifi Protect Network Video Recorder Professional

    Exploits

    No exploit reference

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High