UBIQUITI PATCHES THREE MAX SEVERITY SECURITY VULNERABILITIES

Summary from the TLDR InfoSec newsletter

Ubiquiti patched three critical (CVSS 10) vulnerabilities across their UniFi Protect Application, UniFi Talk Application, and UniFi OS Server products. Two of the vulnerabilities allow attackers to exploit improper input validation in the UniFi Protect Application video surveillance platform and UniFi Talk Application to achieve command injection. The third allows attackers to bypass authentication on UniFi OS devices by exploiting a CRLF injection flaw.