Ubiquiti UniFi Video Local Privilege Escalation Vulnerability (CVE-2016-6914)

Ubiquiti UniFi Video Local Privilege Escalation Vulnerability (CVE-2016-6914)
Ubiquiti UniFi Video Local Privilege Escalation Vulnerability (CVE-2016-6914)

Release date:
Updated on:

Affected Systems:

Ubnt UniFi Video <3.8.0

Description:

Bugtraq id: 102278
CVE (CAN) ID: CVE-2016-6914

Ubiquiti UniFi Video is a Video monitoring and management platform.

Ubiquiti UniFi Video for Windows 3.8.0the prefix used a weak permission for the installation directory. Users can access the trojan taskkill.exe file to obtain SYSTEM permissions.

<* Source: Julien Ahrens
*>

Suggestion:

Vendor patch:

Ubnt
----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Https://www.ubnt.com
Http://seclists.org/fulldisclosure/2017/Dec/83