PSA: Ubiquiti Network compromised again | Critical UniFi OS bug lets hackers gain root without authentication

[Arjun]

Popping Root on UniFi OS Server: Unauthenticated RCE Chain Detection…

Bishop Fox confirmed a full unauthenticated RCE chain in UniFi OS Server that lands a root shell in one request, exposing networks, doors, and cameras.

bishopfox.com

Critical UniFi OS bug lets hackers gain root without authentication

Attackers can chain three already fixed vulnerabilities in the Ubiquiti UniFi OS server to execute remote code with root privileges and without authentication.

www.bleepingcomputer.com

Update your devices ASAP!

​

 

[Molbo]

The exploits only work if you allow access to your console from outside world. NEVER DO THAT!

 

[Arjun]

The exploits only work if you allow access to your console from outside world. NEVER DO THAT!

That means DISABLE REMOTE MANAGEMENT / REMOTE LOGIN found under console settings, enabled by default outside the box

 

[Molbo]

That means DISABLE REMOTE MANAGEMENT / REMOTE LOGIN found under console settings, enabled by default outside the box

Not exactly , it's mainly about Direct Remote Connection (what is basically port forwarding to console WebUI ), but disabling Remote Access completely is not a bad idea.
Only VPN, preferably Wireguard or some Wireguard based Unifi tools such as teleport or site magic.