Vulnerability Description
In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue was fixed by adjusting the .tsExport folder when the controller is running on Windows and adjusting the SafeDllSearchMode in the windows registry when installing UniFi-Video controller. Affected Products: UniFi Video Controller v3.10.2 (for Windows 7/8/10 x64) and prior. Fixed in UniFi Video Controller v3.10.3 and newer.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Ui | Unifi Video | <= 3.10.2 |
| Microsoft | Windows | - |
Related Weaknesses (CWE)
References
- https://community.ui.com/releases/Security-advisory-bulletin-006-006/3cf6264e-e0Vendor Advisory
- https://community.ui.com/releases/Security-advisory-bulletin-006-006/3cf6264e-e0Vendor Advisory
FAQ
What is CVE-2020-8146?
CVE-2020-8146 is a vulnerability with a CVSS score of 7.8 (HIGH). In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue was fixed by adjusting the .tsEx...
How severe is CVE-2020-8146?
CVE-2020-8146 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-8146?
Check the references section above for vendor advisories and patch information. Affected products include: Ui Unifi Video, Microsoft Windows.