CVE-2016-6914

EPSS 1.2%

Ubiquiti UniFi Video before 3.8.0 for Windows uses weak permissions for the installation directory, which allows local users to gain SYSTEM privileges via a Trojan horse taskkill.exe file.

Affected products

n/a · n/a

public PoCs found — 4

githubgithub.com/CybermonkX/CVE-2016-6914-UniFiVideo-LPE★ 0 cve_referencepacketstormsecurity.com/files/145533/Ubiquiti-UniFi-Video-3.7.3-Windows-Local-Privilege-Escalation.htmlunverified cve_referencewww.exploit-db.com/exploits/43390/unverified exploitdbwww.exploit-db.com/exploits/43390unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/145533/Ubiquiti-UniFi-Video-3.7.3-Windows-Local-Privilege-Escalation.html http://seclists.org/fulldisclosure/2017/Dec/83 https://hackerone.com/reports/140793 https://www.exploit-db.com/exploits/43390/http://www.securityfocus.com/bid/102278